default.conf

server {
  listen 443 ssl;
  server_name {{SERVER_NAME}};

  ## Set a variable to help us decide if we need to add the
  ## 'Docker-Distribution-Api-Version' header.
  ## The registry always sets this header.
  ## In the case of nginx performing auth, the header will be unset
  ## since nginx is auth-ing before proxying.
  #map \$upstream_http_docker_distribution_api_version \$docker_distribution_api_version {
  #  'registry/2.0' '';
  #  default registry/2.0;
  #}

  ssl on;
  ssl_certificate /etc/nginx/ssl/docker-registry.crt;
  ssl_certificate_key /etc/nginx/ssl/docker-registry.key;

  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Original-URI $request_uri;
  proxy_read_timeout {{PROXY_TIMEOUT}};
  proxy_send_timeout {{PROXY_TIMEOUT}};

  client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads

  location / {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://{{REGISTRY_HOST}}:{{REGISTRY_PORT}};
  }
  
  location /v1/_ping {
    auth_basic off;
    return 200 'V2 registry';
  }

  location /v2/ {
    # Do not allow connections from docker 1.5 and earlier
    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
      return 404;
    }

    auth_basic "Registry realm";
    auth_basic_user_file /etc/nginx/.htpasswd;
    #auth_basic off;

    add_header Docker-Distribution-Api-Version registry/2.0 always;

    ## If $docker_distribution_api_version is empty, the header will not be added.
    ## See the map directive above where this variable is defined.
    #add_header 'Docker-Distribution-Api-Version' \$docker_distribution_api_version always;
  
    proxy_pass http://{{REGISTRY_HOST}}:{{REGISTRY_PORT}};
  }


}