This was surprisingly time consuming to have all those function properly behind the proxy. Two important tricks that makes things works were: 1. Drop SSL/TLS from registries endpoints (I assume you're aware of consequences when doing such thing) 2. Do not pass domain