Caddyfile

{
    order cache before rewrite
    cache
}

{$ADDRESS:*} {
    # If REGISTRY_ORG is set, limit requests to that path:
    map {$REGISTRY_ORG:""} {path_matcher} {
        ~.+ {$REGISTRY_ORG}/*
        default *
    }

    @api_request {
        path /v2/
        path /v2/{path_matcher}
    }

    route @api_request {
        redir https://{$REGISTRY_HOST}{uri} 307

        # These responses are all constant redirects, except if we actually change to a
        # completely different registry. Cache them for 1 day, so that clients & downstream
        # proxies can avoid fully duplicating basic requests here, so far as possible.
        cache {
            ttl {$CACHE_TIMEOUT:86400}s
            default_cache_control max-age={$CACHE_TIMEOUT:86400}, must-revalidate
            key {
                hide
            }
        }
    }

    route * {
        respond 403 {
            body `{ "errors": [{"message": "Only API requests for {path_matcher} images are supported"}] }`
        }
    }
}