GitLab's Container Registry (docker) behind Apache 2.4 reverse proxy

registry.example.com.conf

<VirtualHost *:80>
  ServerName registry.example.com
  ServerSignature Off

  RewriteEngine on
  RewriteCond %{HTTPS} !=on
  RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [NE,R,L]
</VirtualHost>

<VirtualHost *:443>
  SSLEngine on
  #strong encryption ciphers only
  #see ciphers(1) http://www.openssl.org/docs/apps/ciphers.html
  SSLProtocol all -SSLv2 -SSLv3
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateFile /root/ssl/example.com/*.example.com/certs/*.example.com.cert
  SSLCertificateKeyFile /root/ssl/example.com/*.example.com/private/*.example.com.key
  SSLCACertificateFile /root/ssl/example.com/*.example.com/certs/CA/*.example.com.cert

  ServerName registry.example.com
  ServerSignature   Off
  ProxyRequests     Off
  ProxyPreserveHost On
  Header set Host "registry.example.com"
  <Location />
    Require all granted

    ProxyPass http://127.0.0.1:5000/ timeout=900
    ProxyPassReverse http://127.0.0.1:5000/
  </Location>

  Header always set Docker-Distribution-Api-Version "registry/2.0"
  RequestHeader set X-Forwarded-Proto "https"

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/httpd/registry.example.com_error.log
  CustomLog /var/log/httpd/registry.example.com_forwarded.log common_forwarded
  CustomLog /var/log/httpd/registry.example.com_access.log combined env=!dontlog
  CustomLog /var/log/httpd/registry.example.com.log combined
</VirtualHost>