Public read-only distroless OCI mirror (zot + edge vhost + auditor)

1 files changed, 28 insertions, 0 deletions

diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
new file mode 100644
index 0000000..e486a2f
--- /dev/null
+++ b/deploy/docker-compose.yml
@@ -0,0 +1,28 @@
+# Public read-only OCI mirror of the four upstream Google distroless images.
+#
+# Serving path: public :443 -> edge-nginx (host network, TLS + CrowdSec) ->
+# 127.0.0.1:5000 -> this container. The port publish is loopback-only on
+# purpose: nothing on any host interface can reach zot directly, so the edge
+# vhost is the only entry point.
+#
+# There is no `auth` block and anonymous users only get `read`, so the registry
+# has no push surface at all - not from the internet and not from the LAN.
+# Content arrives exclusively through the built-in sync extension pulling from
+# gcr.io, which is also why the mirror keeps working while the home Forgejo
+# instance (and its runner) is down.
+services:
+  zot:
+    image: ghcr.io/project-zot/zot:v2.1.23
+    container_name: zot-mirror
+    command: ["serve", "/etc/zot/config.json"]
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:5000:5000"
+    volumes:
+      - ./data:/var/lib/registry
+      - ./config.json:/etc/zot/config.json:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"