docker-compose for running a private Docker registry accessible over Tailnet

docker-compose.yml

---
version: '3'

services:
  registry:
    image: registry:2
    hostname: "dzcr.tailnet-003a.ts.net"
    container_name: registry
    volumes:
      - /srv/dev-disk-by-label-storage/dzcr/data:/data
      - /opt/docker/data/dzcr/registry.yml:/etc/docker/registry/config.yml
      - /opt/docker/data/dzcr/auth:/auth
    restart: "unless-stopped"

  registry-ui:
    image: joxit/docker-registry-ui:main
    hostname: "dzcr.tailnet-003a.ts.net"
    container_name: registry-ui
    restart: always
    environment:
      - SINGLE_REGISTRY=true
      - REGISTRY_TITLE="dzCR"
      - DELETE_IMAGES=true
      - SHOW_CONTENT_DIGEST=true
      - NGINX_PROXY_PASS_URL=http://registry:5000
      - SHOW_CATALOG_NB_TAGS=true
      - CATALOG_MIN_BRANCHES=1
      - CATALOG_MAX_BRANCHES=1
      - TAGLIST_PAGE_SIZE=100
      - REGISTRY_SECURED=true
      - CATALOG_ELEMENTS_LIMIT=1000

  tsnsrv:
    build: https://github.com/boinkor-net/tsnsrv.git
    hostname: "dzcr.tailnet-003a.ts.net"
    command:
      - "tsnsrv"
      - "-name"
      - "dzcr"
      - "-stateDir"
      - "/var/lib/tailscale"
      - "http://registry-ui:80"
    environment:
      - "TS_AUTHKEY=${DZCR_TS_AUTHKEY}"
    volumes:
      - /opt/docker/data/dzcr/lib_tailscale:/var/lib/tailscale
      - /etc/ssl/certs:/etc/ssl/certs:ro
    cap_add:
      - NET_ADMIN
      - NET_RAW
    restart: "unless-stopped"