site-default.conf

# registry
server {
	listen 58443 ssl default_server;

	ssl_certificate /ssl/cert.pem;
	ssl_certificate_key /ssl/key.pem;

	client_max_body_size 0;

	location /auth {
		# docker_uath
		proxy_pass http://docker_auth:5001/auth;
		proxy_ssl_trusted_certificate /path/certs/ca.crt;
		proxy_set_header Host $http_host; # required for docker client's sake
		proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_read_timeout 900;
	}

	location / {
		# reg
		proxy_pass http://reg;
		proxy_set_header Host $http_host; # required for docker client's sake
		proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_read_timeout 900;
	}

	location /v2/ {
		# registry itself
		# Do not allow connections from docker 1.5 and earlier
		# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
		if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
			return 404;
		}

		proxy_pass http://registry:5000;
		proxy_set_header  Host              $http_host;   # required for docker client's sake
		proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
		proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
		proxy_set_header  X-Forwarded-Proto $scheme;
		proxy_read_timeout                  900;
		proxy_connect_timeout 600;
		proxy_send_timeout    600;
		proxy_buffering off;
		proxy_request_buffering off;
	}
}