infra/modules/docker-registry/docker-compose.yml

networks:
  registry:
    driver: bridge

services:
  # registry:2 is pinned after the 2026-04-13 + 2026-04-19 orphan-index incidents.
  # Floating tags were swapping to regressed versions between GC runs. Upgrade
  # path: bump all six registry-* services in lockstep and bounce via
  # `systemctl restart docker-compose-registry.service`.
  registry-dockerhub:
    image: registry:2.8.3
    container_name: registry-dockerhub
    restart: always
    volumes:
      - /opt/registry/data/dockerhub:/var/lib/registry
      - /opt/registry/config-dockerhub.yml:/etc/docker/registry/config.yml:ro
    networks:
      - registry
    ports:
      - "5001:5001"
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  registry-ghcr:
    image: registry:2.8.3
    container_name: registry-ghcr
    restart: always
    volumes:
      - /opt/registry/data/ghcr:/var/lib/registry
      - /opt/registry/config-ghcr.yml:/etc/docker/registry/config.yml:ro
    networks:
      - registry
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  registry-quay:
    image: registry:2.8.3
    container_name: registry-quay
    restart: always
    volumes:
      - /opt/registry/data/quay:/var/lib/registry
      - /opt/registry/config-quay.yml:/etc/docker/registry/config.yml:ro
    networks:
      - registry
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  registry-k8s:
    image: registry:2.8.3
    container_name: registry-k8s
    restart: always
    volumes:
      - /opt/registry/data/k8s:/var/lib/registry
      - /opt/registry/config-k8s.yml:/etc/docker/registry/config.yml:ro
    networks:
      - registry
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  registry-kyverno:
    image: registry:2.8.3
    container_name: registry-kyverno
    restart: always
    volumes:
      - /opt/registry/data/kyverno:/var/lib/registry
      - /opt/registry/config-kyverno.yml:/etc/docker/registry/config.yml:ro
    networks:
      - registry
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # registry-private is being kept TEMPORARILY during Phase 3+4 of
  # forgejo-registry-consolidation 2026-05-07 — needed for the orphan-image
  # migration script to pull images one last time before flipping the
  # cluster off it. To remove: drop this entire block, drop the 5050:5050
  # port mapping in nginx, and run on the live VM:
  #   ssh root@10.0.20.10 'cd /opt/registry && docker compose up -d --remove-orphans'
  # …and after 1 week of no incidents, `rm -rf /opt/registry/data/private/`.
  registry-private:
    image: registry:2.8.3
    container_name: registry-private
    restart: always
    volumes:
      - /opt/registry/data/private:/var/lib/registry
      - /opt/registry/config-private.yml:/etc/docker/registry/config.yml:ro
      - /opt/registry/htpasswd:/auth/htpasswd:ro
    networks:
      - registry
    healthcheck:
      # 401 is expected (auth required) — any HTTP response means the registry is healthy
      test: ["CMD", "sh", "-c", "wget -qS -O /dev/null http://127.0.0.1:5000/v2/ 2>&1 | grep -q 'HTTP/'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  nginx:
    image: nginx:alpine
    container_name: registry-nginx
    restart: always
    # 5050 will be dropped after the migration script finishes copying images
    # off registry-private — see Phase 4 of forgejo-registry-consolidation
    # 2026-05-07.
    ports:
      - "5000:5000"
      - "5010:5010"
      - "5020:5020"
      - "5030:5030"
      - "5040:5040"
      - "5050:5050"
    volumes:
      - /opt/registry/nginx.conf:/etc/nginx/nginx.conf:ro
      - /opt/registry/tls:/etc/nginx/tls:ro
      - nginx-cache:/var/cache/nginx
    networks:
      - registry
    depends_on:
      registry-dockerhub:
        condition: service_healthy
      registry-ghcr:
        condition: service_healthy
      registry-quay:
        condition: service_healthy
      registry-k8s:
        condition: service_healthy
      registry-kyverno:
        condition: service_healthy
      registry-private:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://127.0.0.1:5000/v2/ >/dev/null 2>&1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  registry-ui:
    image: joxit/docker-registry-ui:latest
    container_name: registry-ui
    restart: always
    ports:
      - "8080:80"
    environment:
      - NGINX_PROXY_PASS_URL=http://registry-dockerhub:5000
      - DELETE_IMAGES=true
      - SINGLE_REGISTRY=true
      - SHOW_CONTENT_DIGEST=true
      - SHOW_CATALOG_NB_TAGS=true
      - CATALOG_ELEMENTS_LIMIT=1000
      - TAGLIST_PAGE_SIZE=100
      - REGISTRY_TITLE=viktorbarzin.me
    networks:
      - registry
    depends_on:
      registry-dockerhub:
        condition: service_healthy

volumes:
  nginx-cache: