Problems with certificates Caddy / Registry

Hi,

I'm trying to deploy Caddy + Gitlab + Registry with this code and getting the following certificate error.

version: '2'

services:
  caddy:
    restart: always
    image: gotfix/caddy:latest-gitlab
    depends_on:
    - gitlab # Ensures that caddy will relink if gitlab container is restarted
    command:
    - -quic
    ports:
    - 1.2.3.4:80:80
    - 1.2.3.4:443:443
    environment:
    - DUMP_CADDY_CONFIG=true # Will dump Caddyfile in stdout, can be seen by `docker-compose logs -f caddy`
    - GITLAB_HOST=git.example.com # Hostname of the GitLab installation that this server is reachable at
    - TLS_AGREE=true # Indicates that you have read and agree to the Let's Encrypt Subscriber Agreement.
    - CADDY_EMAIL=admin@example.com # Make sure this email is yours and reachable
    - GITLAB_IP=gitlab # The container with GitLab will be available with this alias as part of this docker-compose file
    - GITLAB_REGISTRY_HOST=registry.example.com
    volumes:
    - ./.caddy:/root/.caddy # Your certificates will be stored here
    - ./gitlab/caddy/logs:/var/log/caddy:Z # Caddy logs will be stored here

  redis:
    restart: always
    image: gotfix/redis:latest
    command:
    - --loglevel warning
    volumes:
    - ./gitlab/redis:/var/lib/redis:Z

  postgresql:
    restart: always
    image: gotfix/postgresql:latest
    volumes:
    - ./gitlab/postgresql:/var/lib/postgresql:Z
    environment:
    - DB_USER=gitlab
    - DB_PASS=password
    - DB_NAME=gitlabhq_production
    - DB_EXTENSION=pg_trgm

  gitlab:
    restart: always
    image: gotfix/gitlab:latest
    depends_on:
    - redis
    - postgresql
    ports:
    - "54.36.3.2:8181:8181"
    - "54.36.3.2:8090:8090"
    - "54.36.3.2:10022:22"
    volumes:
    - ./gitlab/data:/home/git/data:Z
    - ./gitlab/logs:/var/log/gitlab:Z
    - ./gitlab/data/certs:/certs
    environment:
# Set to true to enable full debugging information that can be checked with 'docker-compose logs' command
    - DEBUG=false

# Database related parameters
    - DB_ADAPTER=postgresql
    - DB_HOST=postgresql
    - DB_PORT=5432
    - DB_USER=gitlab
    - DB_PASS=password
    - DB_NAME=gitlabhq_production

# Redis parameters
    - REDIS_HOST=redis
    - REDIS_PORT=6379

# Timezone that your docker environment and your gitlab instance will be displaying time in
    - TZ=Europe/Madrid
    - GITLAB_TIMEZONE=Madrid

# Gitlab SSL parameters
    - GITLAB_HTTPS=false

# Gitlab required parameters
    - GITLAB_HOST=git.example.com # Change to the hostname that is also set in Caddy configuration
    - GITLAB_HTTPS=true # Caddy will get certificate from Let's Encrypt, so leave it as true
    - GITLAB_SSH_PORT=10022
    - GITLAB_RELATIVE_URL_ROOT=

# The following 3 parameters are important and should be backed-up, and kept secret.
# Can be generated by 'pwgen -Bsv1 64' command on ubuntu system or if you have pwgen installed
    - GITLAB_SECRETS_DB_KEY_BASE=nqzfVV3vXpPXCTC7dTwb7H7mCHsXC37Pg7XHNT9Tswx4JVC7kP9FXmjCk7nPxnk4
    - GITLAB_SECRETS_SECRET_KEY_BASE=nqzfVV3vXpPXCTC7dTwb7H7mCHsXC37Pg7XHNT9Tswx4JVC7kP9FXmjCk7nPxnk4
    - GITLAB_SECRETS_OTP_KEY_BASE=nqzfVV3vXpPXCTC7dTwb7H7mCHsXC37Pg7XHNT9Tswx4JVC7kP9FXmjCk7nPxnk4

# Set Gitlab administator (root) email and password.
# The password for the root user on first run

    - GITLAB_NOTIFY_ON_BROKEN_BUILDS=true
    - GITLAB_NOTIFY_PUSHER=false

# Make sure to update the following section with correct email addresses
    - GITLAB_EMAIL=notifications@example.com
    - GITLAB_EMAIL_REPLY_TO=noreply@example.com
    - GITLAB_INCOMING_EMAIL_ADDRESS=reply@example.com

    - GITLAB_BACKUP_SCHEDULE=daily
    - GITLAB_BACKUP_TIME=01:00

# Please configure the following section with correct parameters
    - SMTP_ENABLED=false
    - SMTP_DOMAIN=www.example.com
    - SMTP_HOST=smtp.gmail.com
    - SMTP_PORT=587
    - SMTP_USER=mailer@example.com
    - SMTP_PASS=password
    - SMTP_STARTTLS=true
    - SMTP_AUTHENTICATION=login

    - IMAP_ENABLED=false
    - IMAP_HOST=imap.gmail.com
    - IMAP_PORT=993
    - IMAP_USER=mailer@example.com
    - IMAP_PASS=password
    - IMAP_SSL=true
    - IMAP_STARTTLS=false

    - OAUTH_ENABLED=false
    - OAUTH_AUTO_SIGN_IN_WITH_PROVIDER=
    - OAUTH_ALLOW_SSO=
    - OAUTH_BLOCK_AUTO_CREATED_USERS=true
    - OAUTH_AUTO_LINK_LDAP_USER=false
    - OAUTH_AUTO_LINK_SAML_USER=false
    - OAUTH_EXTERNAL_PROVIDERS=

    - OAUTH_CAS3_LABEL=cas3
    - OAUTH_CAS3_SERVER=
    - OAUTH_CAS3_DISABLE_SSL_VERIFICATION=false
    - OAUTH_CAS3_LOGIN_URL=/cas/login
    - OAUTH_CAS3_VALIDATE_URL=/cas/p3/serviceValidate
    - OAUTH_CAS3_LOGOUT_URL=/cas/logout

    - OAUTH_GOOGLE_API_KEY=
    - OAUTH_GOOGLE_APP_SECRET=
    - OAUTH_GOOGLE_RESTRICT_DOMAIN=

    - OAUTH_FACEBOOK_API_KEY=
    - OAUTH_FACEBOOK_APP_SECRET=

    - OAUTH_TWITTER_API_KEY=
    - OAUTH_TWITTER_APP_SECRET=

    - OAUTH_GITHUB_API_KEY=
    - OAUTH_GITHUB_APP_SECRET=
    - OAUTH_GITHUB_URL=
    - OAUTH_GITHUB_VERIFY_SSL=

    - OAUTH_GITLAB_API_KEY=
    - OAUTH_GITLAB_APP_SECRET=

    - OAUTH_BITBUCKET_API_KEY=
    - OAUTH_BITBUCKET_APP_SECRET=

    - OAUTH_SAML_ASSERTION_CONSUMER_SERVICE_URL=
    - OAUTH_SAML_IDP_CERT_FINGERPRINT=
    - OAUTH_SAML_IDP_SSO_TARGET_URL=
    - OAUTH_SAML_ISSUER=
    - OAUTH_SAML_LABEL="Our SAML Provider"
    - OAUTH_SAML_NAME_IDENTIFIER_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:transient
    - OAUTH_SAML_GROUPS_ATTRIBUTE=
    - OAUTH_SAML_EXTERNAL_GROUPS=
    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_EMAIL=
    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_NAME=
    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_FIRST_NAME=
    - OAUTH_SAML_ATTRIBUTE_STATEMENTS_LAST_NAME=

    - OAUTH_CROWD_SERVER_URL=
    - OAUTH_CROWD_APP_NAME=
    - OAUTH_CROWD_APP_PASSWORD=

    - OAUTH_AUTH0_CLIENT_ID=
    - OAUTH_AUTH0_CLIENT_SECRET=
    - OAUTH_AUTH0_DOMAIN=

    - OAUTH_AZURE_API_KEY=
    - OAUTH_AZURE_API_SECRET=
    - OAUTH_AZURE_TENANT_ID=

# Parameters to configure Girlab Pages
    - GITLAB_PAGES_ENABLED=
    - GITLAB_PAGES_DOMAIN=
    - GITLAB_PAGES_PORT=
    - GITLAB_PAGES_PROXY_PORT=
    - GITLAB_PAGES_HTTPS=
    - GITLAB_PAGES_METRICS_PORT=
    - SSL_PAGES_KEY_PATH=
    - SSL_PAGES_CERT_PATH=
    - GITLAB_PAGES_EXTERNAL_HTTP=
    - GITLAB_PAGES_EXTERNAL_HTTPS=

# Gitlab monitor that is used for collection of metrics by prometheus
    - GITLAB_MONITOR_ENABLED=
    - GITLAB_MONITOR_PORT=


    - GITLAB_REGISTRY_ENABLED=true
    - GITLAB_REGISTRY_HOST=registry.example.com
    - GITLAB_REGISTRY_PORT=5000
    - GITLAB_REGISTRY_API_URL=http://registry:5000


  registry:
    restart: always
    image: registry:2.4.1
    ports:
    - 1.2.3.4:5000:5000
    volumes:
    - ./gitlab/shared/registry:/registry
    - ./certs:/certs
    environment:
    - REGISTRY_LOG_LEVEL=info
    - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/registry
    - REGISTRY_AUTH_TOKEN_REALM=https://git.example.com/jwt/auth
    - REGISTRY_AUTH_TOKEN_SERVICE=container_registry
    - REGISTRY_AUTH_TOKEN_ISSUER=gitlab-issuer
    - REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE=/certs/registry.example.com.crt
    - REGISTRY_STORAGE_DELETE_ENABLED=true

The error:

➜  ~ docker login registry.example.com
Username: username
Password: 
Error response from daemon: Get https://registry.example.com/v2/: x509: certificate is valid for git.xscru.com, not registry.example.com

I'm not sure how to handle with the registry certificates... I tried to manually generate and also tried to import certificates generated by Caddy. There's no docker-compose.yml working for this setup? I checked some configurations published on Github but no one is working with this combination.

Regards

Start with the posted docker-compose.yml and run the Caddy and registry services while reviewing their certificate-related logs and mounted paths. Trace the certificate presented for registry.example.com and compare it with the registry configuration; done means docker login registry.example.com no longer reports a hostname mismatch.