feat: path prefix proxy credentials (#478)

donCappo · awoimbee · web-flow · commit fa3c523fca5e · 2026-04-01T18:07:23.000+02:00
* Add path_prefix support for scoped proxy registry credentials

Some container registries (e.g., GitLab) issue scoped deploy tokens
per project. When proxying from a single registry host with multiple
projects, each project needs its own credentials. Previously, Trow
only supported one credential set per host.

Add an optional `path_prefix` field to `SingleRegistryProxyConfig`
that enables different credentials for different repo paths on the
same host. Uses longest-prefix matching with host-only fallback.

---------

Co-authored-by: Arthur Woimbée &lt;arthur.woimbee@gmail.com&gt;
Co-authored-by: Pavel Vitous &lt;pavel@vi-to.us&gt;
diff --git a/charts/trow/values.yaml b/charts/trow/values.yaml
@@ -50,6 +50,16 @@ trow:
       #     username: toto
       #     password: titi
       #   - host: ghcr.io
+      #   ## Use path_prefix for scoped credentials on the same host
+      #   ## (e.g. GitLab deploy tokens per project):
+      #   - host: registry.example.com
+      #     path_prefix: project-a
+      #     username: project-a-deploy-token
+      #     password: glpat-xxx
+      #   - host: registry.example.com
+      #     path_prefix: project-b
+      #     username: project-b-deploy-token
+      #     password: glpat-yyy
       # max_size: 50GiB
   ## For more info on log levels see https://docs.rs/tracing-subscriber/0.3.17/tracing_subscriber/filter/struct.EnvFilter.html
   logLevel: info
diff --git a/docker/multi-arch.sh b/docker/multi-arch.sh
@@ -5,7 +5,8 @@ set -exo pipefail
 src_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 cd "$src_dir"
 
-GH_REPO="ghcr.io/trow-registry/trow"
+# Use GITHUB_REPOSITORY if available (e.g. in CI), otherwise default to upstream
+GH_REPO="ghcr.io/${GITHUB_REPOSITORY:-trow-registry/trow}"
 
 
 # Check if cargo-sqlx is installed
diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md
@@ -65,6 +65,39 @@ Trow will keep a cached copy and check for new versions on each pull. The check
 request which does not count towards the dockerhub rate limits. If the image cannot be pulled a cached
 version will be returned, if available. This can be used to effectively mitigate availability issues with registries.
 
+### Scoped credentials with `path_prefix`
+
+Some container registries (e.g. GitLab) issue scoped deploy tokens that only grant
+access to a single project. When proxying multiple projects from the same registry
+host, each project needs its own credentials. The `path_prefix` field allows you to
+configure different credentials for different repository paths on the same host:
+
+```yaml
+registry_proxies:
+  registries:
+    # Scoped token for project-a
+    - host: registry.example.com
+      path_prefix: project-a
+      username: project-a-deploy-token
+      password: glpat-aaa
+
+    # Scoped token for project-b
+    - host: registry.example.com
+      path_prefix: project-b
+      username: project-b-deploy-token
+      password: glpat-bbb
+
+    # Fallback for any other repo on this host (optional)
+    - host: registry.example.com
+      username: default-token
+      password: glpat-ccc
+```
+
+When Trow resolves credentials for a proxied image, it uses **longest-prefix matching**:
+an image like `registry.example.com/project-a/app` will match the `project-a` entry.
+If no prefix matches, a host-only entry (without `path_prefix`) is used as a fallback.
+If neither matches, the image is proxied without authentication.
+
 ### Configuring containerd
 
 See [the containerd docs](https://github.com/containerd/containerd/blob/main/docs/hosts.md#setup-default-mirror-for-all-registries).
diff --git a/src/configuration.rs b/src/configuration.rs
@@ -35,11 +35,27 @@ pub struct RegistryProxiesConfig {
     pub max_size: Option<size::Size>,
 }
 
+fn normalize_path_prefix<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let opt = Option::<String>::deserialize(deserializer)?;
+    Ok(opt
+        .map(|s| s.trim_matches('/').to_string())
+        .filter(|s| !s.is_empty()))
+}
+
 #[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
 pub struct SingleRegistryProxyConfig {
     /// What containerd calls "namespace" (ghcr.io, docker.io, ...)
     /// This can be empty !!
     pub host: String,
+    /// Optional path prefix for scoped credential matching.
+    /// Allows different credentials for different projects on the same registry host.
+    /// Example: "system" matches repos like "system/app", "system/worker".
+    /// When multiple entries match the same host, the longest matching prefix wins.
+    #[serde(default, deserialize_with = "normalize_path_prefix")]
+    pub path_prefix: Option<String>,
     /// TODO: insecure currently means "use HTTP", we should also support self-signed TLS
     #[serde(default)]
     pub insecure: bool,
@@ -58,11 +74,30 @@ impl Default for RegistryProxiesConfig {
 }
 
 impl RegistryProxyConfigs {
-    pub fn get_for<'a>(&'a self, registry_host: &str) -> Option<&'a SingleRegistryProxyConfig> {
-        self.0
-            .iter()
-            .find(|&registry| registry.host == registry_host)
-            .map(|v| v as _)
+    pub fn get_for<'a>(
+        &'a self,
+        registry: &str,
+        repo: &str,
+    ) -> Option<&'a SingleRegistryProxyConfig> {
+        let matches = self.0.iter().filter_map(|proxy| {
+            if proxy.host == registry {
+                if let Some(proxy_prefix) = proxy.path_prefix.as_deref() {
+                    // for prefix "org" match org/toto, not org_b/toto
+                    if repo == proxy_prefix
+                        || (repo.starts_with(proxy_prefix)
+                            && repo.as_bytes().get(proxy_prefix.len()) == Some(&b'/'))
+                    {
+                        return Some((proxy_prefix.len(), proxy));
+                    }
+                } else {
+                    return Some((0, proxy));
+                }
+            }
+            None
+        });
+        matches
+            .max_by_key(|(prefix_len, _)| *prefix_len)
+            .map(|(_, registry)| registry)
     }
 }
 
@@ -71,3 +106,71 @@ impl From<Vec<SingleRegistryProxyConfig>> for RegistryProxyConfigs {
         RegistryProxyConfigs(vec)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_registry_proxy_deserialize_path_prefix() {
+        let proxy_config: SingleRegistryProxyConfig =
+            serde_json::from_str(r#"{"host": "registry.example.com", "path_prefix": "/org/sub/"}"#)
+                .unwrap();
+        assert_eq!(proxy_config.path_prefix.unwrap(), "org/sub");
+
+        let proxy_config: SingleRegistryProxyConfig =
+            serde_json::from_str(r#"{"host": "registry.example.com", "path_prefix": "/"}"#)
+                .unwrap();
+        assert_eq!(proxy_config.path_prefix, None);
+    }
+
+    #[test]
+    fn test_registry_proxy_configs_path_prefix_longest_match_wins() {
+        let config = RegistryProxiesConfig {
+            registries: vec![
+                SingleRegistryProxyConfig {
+                    host: "registry.example.com".to_string(),
+                    username: Some("default".to_string()),
+                    ..Default::default()
+                },
+                SingleRegistryProxyConfig {
+                    host: "registry.example.com".to_string(),
+                    path_prefix: Some("org".to_string()),
+                    username: Some("org-token".to_string()),
+                    ..Default::default()
+                },
+                SingleRegistryProxyConfig {
+                    host: "registry.example.com".to_string(),
+                    path_prefix: Some("org/sub".to_string()),
+                    username: Some("org-sub-token".to_string()),
+                    ..Default::default()
+                },
+            ]
+            .into(),
+            ..Default::default()
+        };
+        // "org/sub/app" matches both, but "org/sub" is longer
+        let proxy = config
+            .registries
+            .get_for("registry.example.com", "org/sub/app");
+        assert_eq!(proxy.unwrap().username, Some("org-sub-token".to_string()));
+
+        // "org/other" matches only "org"
+        let proxy = config
+            .registries
+            .get_for("registry.example.com", "org/other");
+        assert_eq!(proxy.unwrap().username, Some("org-token".to_string()));
+
+        // no path_prefix match
+        let proxy = config
+            .registries
+            .get_for("registry.example.com", "outta-this-world");
+        assert_eq!(proxy.unwrap().username, Some("default".to_string()));
+
+        // doesn't match path prefix across '/' boundary
+        let proxy = config
+            .registries
+            .get_for("registry.example.com", "org_b/app");
+        assert_eq!(proxy.unwrap().username, Some("default".to_string()));
+    }
+}
diff --git a/src/routes/manifest.rs b/src/routes/manifest.rs
@@ -54,7 +54,7 @@ async fn get_manifest(
             .config_file
             .registry_proxies
             .registries
-            .get_for(image.registry());
+            .get_for(image.registry(), image.repository());
         download_image(&image, proxy_config, &state).await?
     } else {
         let digest = if let Some(tag) = image.tag() {
