registry: Upgrade to v3, lower bcrypt cost, route /v2 directly

- Upgrade registry to 3.0.0 (new config path, redis addrs)
- Generate htpasswd with bcrypt cost 5; cost 12 added ~350ms per request
- Route /v2 straight to the registry instead of through the UI's nginx

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/registry/config/config.yml

@@ -11,7 +11,7 @@ storage:
   {{ registry_storage|to_nice_yaml(indent=2, width=140)|indent(2) }}
 
 redis:
-  addr: redis:6379
+  addrs: [redis:6379]
 
 http:
   addr: :5000

services/registry/stack.yml

@@ -9,20 +9,28 @@ services:
           memory: 256M
 
   registry:
-    image: registry:2
+    image: registry:3.0.0
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/docker/registry/config.yml
+        target: /etc/distribution/config.yml
     environment:
       - REGISTRY_STORAGE_DELETE_ENABLED=true
     deploy:
       placement:
         constraints:
           - node.role == manager
-    networks: ['default']
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.{{ service }}-api.rule=Host(`{{ service }}.{{ main_domain }}`) && PathPrefix(`/v2`)
+        - traefik.http.routers.{{ service }}-api.priority=100
+        - traefik.http.routers.{{ service }}-api.tls=true
+        - traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
+        - traefik.http.routers.{{ service }}-api.service={{ service }}-api
+        - traefik.http.services.{{ service }}-api.loadbalancer.server.port=5000
+    networks: ['{{ ingress_network }}', 'default']
 
   ui:
     image: joxit/docker-registry-ui:2.5.6
@@ -42,14 +50,14 @@ services:
     networks: ['{{ ingress_network }}', 'default']
 
   image-cleanup-job:
-    image: registry:2
-    command: ["registry", "garbage-collect", "/etc/docker/registry/config.yml", "-m"]
+    image: registry:3.0.0
+    command: ["registry", "garbage-collect", "/etc/distribution/config.yml", "-m"]
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/docker/registry/config.yml
+        target: /etc/distribution/config.yml
     deploy:
       placement:
         constraints:

services/registry/tasks/config.yml

@@ -7,16 +7,17 @@
   tags:
     - config
 
+# Registry checks the bcrypt hash on every request, so a low cost keeps it fast.
+# Salt is derived from the user name to keep the file stable between runs.
 - name: 'Generate passwords file for "{{ service }}"'
-  community.general.htpasswd:
-    path: "{{ remote_service_path }}/config/htpasswd"
-    name: "{{ registry_user.name }}"
-    crypt_scheme: bcrypt
-    password: "{{ registry_user.password }}"
-  loop: "{{ registry_users }}"
-  loop_control:
-    loop_var: registry_user
-    label: "{{ registry_user.name }}"
+  ansible.builtin.copy:
+    dest: "{{ remote_service_path }}/config/htpasswd"
+    content: |
+      {% for registry_user in registry_users %}
+      {{ registry_user.name }}:{{ registry_user.password | password_hash('bcrypt', salt=((service ~ ':' ~ registry_user.name) | hash('sha256'))[:22], rounds=registry_bcrypt_rounds) }}
+      {% endfor %}
+    mode: "0600"
+  no_log: true
   tags:
     - config
 

services/registry/vars/main.yml

@@ -0,0 +1,2 @@
+---
+registry_bcrypt_rounds: 5