# Managed by Ansible — do not edit manually
services:
  registry:
    image: registry:2
    container_name: registry
    restart: unless-stopped
    environment:
      REGISTRY_AUTH: htpasswd
      REGISTRY_AUTH_HTPASSWD_REALM: Container Registry
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
    volumes:
      - {{ registry_data_dir }}/data:/var/lib/registry
      - {{ registry_data_dir }}/auth:/auth:ro
    networks:
      - traefik_public
      - registry_internal
    labels:
      - "traefik.enable=true"
      # PathPrefix(/v2) is more specific than the UI's bare Host rule — Traefik routes docker CLI traffic here
      - "traefik.http.routers.registry-api.rule=Host(`{{ domain_registry }}`) && PathPrefix(`/v2`)"
      - "traefik.http.routers.registry-api.entrypoints=websecure"
      - "traefik.http.routers.registry-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.registry.loadbalancer.server.port=5000"

  registry-ui:
    image: joxit/docker-registry-ui:{{ registry_ui_version }}
    container_name: registry-ui
    restart: unless-stopped
    environment:
      - SINGLE_REGISTRY=true
      - REGISTRY_SECURED=true
      - REGISTRY_URL=https://{{ domain_registry }}
      - DELETE_IMAGES=true
      - SHOW_CATALOG_NB_TAGS=true
      - SHOW_CONTENT_DIGEST=true
      - CATALOG_ELEMENTS_LIMIT=1000
      - TAGLIST_PAGE_SIZE=100
      - REGISTRY_TITLE=Container Registry
    networks:
      - traefik_public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.registry-ui.rule=Host(`{{ domain_registry }}`)"
      - "traefik.http.routers.registry-ui.entrypoints=websecure"
      - "traefik.http.routers.registry-ui.tls.certresolver=letsencrypt"
      - "traefik.http.services.registry-ui.loadbalancer.server.port=80"

networks:
  traefik_public:
    external: true
  registry_internal:
    internal: true