# Public read-only OCI mirror of the four upstream Google distroless images.
#
# Serving path: public :443 -> edge-nginx (host network, TLS + CrowdSec) ->
# 127.0.0.1:5000 -> this container. The port publish is loopback-only on
# purpose: nothing on any host interface can reach zot directly, so the edge
# vhost is the only entry point.
#
# There is no `auth` block and anonymous users only get `read`, so the registry
# has no push surface at all - not from the internet and not from the LAN.
# Content arrives exclusively through the built-in sync extension pulling from
# gcr.io, which is also why the mirror keeps working while the home Forgejo
# instance (and its runner) is down.
services:
  zot:
    image: ghcr.io/project-zot/zot:v2.1.23
    container_name: zot-mirror
    command: ["serve", "/etc/zot/config.json"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:5000:5000"
    volumes:
      - ./data:/var/lib/registry
      - ./config.json:/etc/zot/config.json:ro
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"