infra/modules/docker-registry/nginx_registry.conf

worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /tmp/nginx.pid;

events {
    worker_connections 1024;
}

http {
    proxy_cache_path /var/cache/nginx/registry
        levels=1:2
        keys_zone=registry:500m
        max_size=50g
        inactive=24h
        use_temp_path=off;

    log_format registry '$remote_addr [$time_local] "$request" '
                        '$status $body_bytes_sent '
                        'upstream=$upstream_addr time=$upstream_response_time '
                        'cache=$upstream_cache_status';

    access_log /var/log/nginx/access.log registry;

    # --- Upstreams ---

    upstream dockerhub {
        server registry-dockerhub:5000;
        keepalive 32;
    }

    upstream ghcr {
        server registry-ghcr:5000;
        keepalive 32;
    }

    upstream quay {
        server registry-quay:5000;
        keepalive 32;
    }

    upstream k8s {
        server registry-k8s:5000;
        keepalive 32;
    }

    upstream kyverno {
        server registry-kyverno:5000;
        keepalive 32;
    }

    upstream private {
        server registry-private:5000;
        keepalive 32;
    }

    # --- Docker Hub (port 5000) ---

    server {
        listen 5000;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering on;

        location /v2/ {
            proxy_pass http://dockerhub;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";

            proxy_cache registry;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 15m;
            proxy_cache_lock_age 15m;
            proxy_cache_use_stale updating;
            proxy_cache_valid 200 206 24h;
            proxy_cache_methods GET;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }

    # --- GHCR (port 5010) ---

    server {
        listen 5010;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering on;

        location /v2/ {
            proxy_pass http://ghcr;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";

            proxy_cache registry;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 15m;
            proxy_cache_lock_age 15m;
            proxy_cache_use_stale updating;
            proxy_cache_valid 200 206 24h;
            proxy_cache_methods GET;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }

    # --- Quay (port 5020) ---

    server {
        listen 5020;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering on;

        location /v2/ {
            proxy_pass http://quay;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";

            proxy_cache registry;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 15m;
            proxy_cache_lock_age 15m;
            proxy_cache_use_stale updating;
            proxy_cache_valid 200 206 24h;
            proxy_cache_methods GET;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }

    # --- registry.k8s.io (port 5030) ---

    server {
        listen 5030;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering on;

        location /v2/ {
            proxy_pass http://k8s;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";

            proxy_cache registry;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 15m;
            proxy_cache_lock_age 15m;
            proxy_cache_use_stale updating;
            proxy_cache_valid 200 206 24h;
            proxy_cache_methods GET;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }

    # --- reg.kyverno.io (port 5040) ---

    server {
        listen 5040;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering on;

        location /v2/ {
            proxy_pass http://kyverno;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";

            proxy_cache registry;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 15m;
            proxy_cache_lock_age 15m;
            proxy_cache_use_stale updating;
            proxy_cache_valid 200 206 24h;
            proxy_cache_methods GET;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }

    # --- Private R/W Registry (port 5050) ---

    server {
        listen 5050;
        server_name _;

        client_max_body_size 0;
        proxy_request_buffering off;
        proxy_buffering off;
        chunked_transfer_encoding on;

        location /v2/ {
            proxy_pass http://private;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_read_timeout 900;
            proxy_send_timeout 900;
        }

        location / {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }
}