unkin-agent
32da0fd750
Add ARTIFACTAPI_AUTH_UPLOADS to require a verified token for local uploads, deletes, evictions, /api/v1 publishes and /v2 push. Accept the token as Bearer, Token, Basic password or bare header, and serve a Docker registry token endpoint so pulls stay anonymous.
588 B
588 B
Local npm registry
A local npm repo is a real npm registry: npm publish (scoped and unscoped)
and npm install work against /api/v1/local/<repo>/. npm requires an
_authToken for the registry before it will publish; any value works unless
uploads are gated.
# .npmrc
registry=https://artifactapi.example.com/api/v1/local/<repo>/
//artifactapi.example.com/api/v1/local/<repo>/:_authToken=unused
Versions are immutable: republishing an existing version is rejected. The
dist-tags sent with a publish (latest, or --tag) move to that version.