[Service]
# Route every outbound docker registry pull through the registry-cache
# MITM proxy (see compose.yml `registry-cache` service). The proxy
# performs SSL bumping; the CA cert must be installed first by
# registry-cache-ca.sh (ExecStartPre below).
#
# Catch-all by design: rpardini/docker-registry-proxy intercepts traffic
# to any registry the inner dockerd pulls from (docker.io, ghcr.io,
# quay.io, …) and caches blobs/manifests so re-deploys, parallel CI
# shards, and local fresh-purges do not trigger live registry round-trips.
#
# Pulls only — pushes are not intercepted by rpardini's proxy.
Environment="HTTP_PROXY=http://infinito-registry-cache:3128"
Environment="HTTPS_PROXY=http://infinito-registry-cache:3128"
Environment="NO_PROXY=localhost,127.0.0.1,::1,infinito-registry-cache,gcr.io,storage.googleapis.com,googleusercontent.com"
ExecStartPre=/usr/local/bin/registry-cache-ca.sh