My bad, I meant the recommended deployment is to bring your own auth provider, but normal username/password is fine too. Glad it works!

Assuming you just want file sync and storage, if you can live without External Storage (having another SFTP/WebDAV/whatever backend), then I think oCIS is great for you. It also expect an OIDC auth provider by default - this guide helped me through. Note that you have to configure the S3 storage driver in oCIS and properly backup your buckets and metadata.

For Talk you can setup an internal Matrix and TURN server too. I recommend conduwuit if you want something lightweight, or Synapse (quite heavy) if you need OIDC integration.

An alternative method is to run an actions workflow that syncs from upstream images directly, like what Forgejo actually do.

https://code.forgejo.org/forgejo/oci-mirror

Update: there seems to be a more “native” storage driver for OCIS that is currently WIP. It seems very exciting

FYI there is an upcoming storage driver that can solve this issue

AFAIK, Syncthing clones the entire folder across peers (the server is just another peer it seems), which isn’t ideal for my use case Do you know any current way to configure it for selective syncing?