An example Nginx config for a private Docker registry to enable unauthenticated, read-only access on non-volatile HTTP methods

docker-regsitry.conf

upstream docker-registry {
    leastconn;
    server hostname1:port;
    server hostname2:port;
}

server {
    listen       80;
    server_name  docker.your.domain;
    rewrite      ^ https://$server_name$request_uri? permanent;
}

server {
    listen      442;
    server_name docker.your.domain;

    ssl                  on;
    ssl_certificate      /path/to/docker.crt;
    ssl_certificate_key  /path/to/docker.key;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
    ssl_prefer_server_ciphers on;

    client_max_body_size 0;
    chunked_transfer_encoding on;

    location / {
        limit_except GET HEAD OPTIONS {
            auth_basic            "Restricted";
            auth_basic_user_file  /path/to/auth.passwd;
        }

        proxy_read_timeout  900;
        proxy_pass          http://docker-registry;
        proxy_set_header    Host           $http_host;
        proxy_set_header    X-Real-IP      $remote_addr;
        proxy_set_header    Authorization  "";
    }

    location /v1/_ping {
        auth_basic off;
        proxy_pass http://docker-registry;
    }

    location /_ping {
        auth_basic off;
        proxy_pass http://docker-registry;
    }
}