Depending on your use-case, the default registry mirroring you've linked works well.

It... does not have a UI or the GC/pre-download stuff, but it absolutely works for private images (see: https://distribution.github.io/distribution/recipes/mirror/#...)

I've been using it as a cache for a while locally and it's a solid choice.

---

I guess an edit - it does also have basic TTL, which might cover your GC case, but it's not very configurable or customizable. It's literally just a TTL flag on the proxied image.