Can someone give a hand and help properly configure container registry in Gitlab? I'm trying to use it with self signed certificates on localhost, used tons of different script to generate *.crt and *.key but nothing seem to work and I can't log in to the registry:

docker login localhost:5005 gives me certificate errors:

Error response from daemon: Get https://localhost:5005/v2/: x509: certificate signed by unknown authority.

I've also tried to copy generated certificate and move it to:

/etc/docker/certs.d/localhost:5005/ca.cert

/etc/docker/certs.d/localhost:5005/ca.key

Restarted docker service after with: sudo service docker restart

I've also added insecure registry entry to:

/etc/default/docker
DOCKER_OPTS="--insecure-registry localhost:5005"

Above error seem common error but I googled tons of different threads and nothing seem to work. Below docker-compose file I use to spin it up:

version: '3.7'
services:
  web:
    image: 'gitlab/gitlab-ce:latest'
    restart: always
    hostname: 'localhost'
    container_name: gitlab-ce
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://localhost'
        registry_external_url 'https://localhost:5005'
        gitlab_rails['lfs_enabled'] = true
        gitlab_rails['gitlab_shell_ssh_port'] = 2222
        registry_nginx['enable'] = true
        registry_nginx['listen_port'] = 5005
        registry_nginx['redirect_http_to_https'] = true
        registry_nginx['ssl_certificate'] = "/ssl_certs/localhost.crt"
        registry_nginx['ssl_certificate_key'] = "/ssl_certs/localhost.key"
    ports:
      - '8084:80'
      - '8443:443'
      - '2222:22'
      - '5005:5005'
    volumes:
      - './vol/config:/etc/gitlab'
      - './vol/logs:/var/log/gitlab'
      - './vol/data:/var/opt/gitlab'
      - './vol/ssl_certs:/ssl_certs'
    networks:
      - gitlab
  gitlab-runner:
    image: gitlab/gitlab-runner:alpine
    container_name: gitlab-runner    
    restart: always
    depends_on:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - './vol/gitlab-runner:/etc/gitlab-runner'
    networks:
      - gitlab
networks:
  gitlab:
    name: gitlab-network

Script to generate my certificates:

#!/usr/bin/env bash

# Set the TLD domain we want to use
BASE_DOMAIN="localhost"

# Days for the cert to live
DAYS=1095

# A blank passphrase
PASSPHRASE=""

# Generated configuration file
CONFIG_FILE="config.txt"

cat > $CONFIG_FILE <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
x509_extensions = v3_req
distinguished_name = dn
[dn]
C = CA
ST = BC
L = Vancouver
O = Example Corp
OU = Testing Domain
emailAddress = webmaster@$BASE_DOMAIN
CN = $BASE_DOMAIN
[v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = *.$BASE_DOMAIN
DNS.2 = $BASE_DOMAIN
EOF

# The file name can be anything
FILE_NAME=$BASE_DOMAIN

echo "Generating certs for $BASE_DOMAIN"

# Generate our Private Key, CSR and Certificate
# Use SHA-2 as SHA-1 is unsupported from Jan 1, 2017

openssl req -new -x509 -newkey rsa:2048 -sha256 -nodes -keyout "$FILE_NAME.key" -days $DAYS -out "$FILE_NAME.crt" -passin pass:$PASSPHRASE -config "$CONFIG_FILE"

# OPTIONAL - write an info to see the details of the generated crt
openssl x509 -noout -fingerprint -text < "$FILE_NAME.crt" > "$FILE_NAME.info"

# Protect the key
chmod 400 "$FILE_NAME.key"

EDIT:

I finally found working configuration:

      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.gitlabenv.com:8443'
        registry_external_url 'https://registry.gitlabenv.com:5005'
        
        gitlab_rails['time_zone'] = 'America/Chicago'
        gitlab_rails['gitlab_shell_ssh_port'] = 2222
        gitlab_rails['lfs_enabled'] = true

        registry_nginx['enable'] = true
        registry_nginx['ssl_certificate'] = "/etc/ssl/certs/gitlab/server-cert.pem"
        registry_nginx['ssl_certificate_key'] = "/etc/ssl/certs/gitlab/server-key.pem"
        
        nginx['listen_port'] = 443
        nginx['redirect_http_to_https'] = true
        nginx['ssl_certificate'] = "/etc/ssl/certs/gitlab/server-cert.pem"
        nginx['ssl_certificate_key'] = "/etc/ssl/certs/gitlab/server-key.pem"