Deploy Verdaccio in one click

What is Verdaccio?

Verdaccio is a lightweight private npm registry, which teams and solo developers run in place of npm’s paid private packages, GitHub Packages or JFrog Artifactory. You publish packages to it with npm publish, and install them with npm, yarn or pnpm as from npmjs. It needs no database: packages and their metadata are files on its disk.

It is also a proxy of the public registry: a package it does not hold comes from npmjs through its uplink and is kept, so later installs come from Verdaccio, not from npmjs, and a scope such as @yourname can stay private while everything else comes from npm. Its web page shows each package’s readme, versions and dependencies.

This template runs Verdaccio with its storage in a volume and one account, the username and password you give, written into its htpasswd file at every start. Sign-up is off, and packages, your own and npm’s, are read and installed only by a user who signed in, so the registry is no open mirror for strangers.

Hosting Verdaccio on Pethost

1. You sign in to Pethost with a passkey, GitHub or Google. No machine yet? You pick a plan, and the link waits until it is ready.
2. New project opens at Verdaccio. You fill in what it asks for and click Create project: Username, Admin password.
3. In a minute or two Verdaccio is live at its own address with HTTPS. Its secrets are made at random, and its data is in the nightly backup.
4. It is a project like any other: you or your agent can change it, roll it back or restore it.

Questions about Verdaccio

Verdaccio Docker Compose file

The template is this compose.yaml and the variables written into the project’s .env as it is created. Pethost runs the file as it is written.

Containers: verdaccio (verdaccio/verdaccio:6).

Volumes, in the nightly backup: storage.

services:
  verdaccio:
    image: verdaccio/verdaccio:6
    restart: unless-stopped
    environment:
      VERDACCIO_PUBLIC_URL: ${URL}
      ADMIN_USERNAME: ${ADMIN_USERNAME}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
    # The administrator's line of the htpasswd file is written from the username and password
    # given at every start, so its password is the one in the project's .env; the other lines,
    # users the administrator added, stay as they are.
    command:
      - /bin/sh
      - -c
      - |
        node -e '
          const fs = require("node:fs");
          const bcrypt = require("/usr/local/lib/node_modules/verdaccio/node_modules/bcryptjs");
          const file = "/verdaccio/storage/htpasswd";
          const { ADMIN_USERNAME: name, ADMIN_PASSWORD: password } = process.env;
          const lines = fs.existsSync(file) ? fs.readFileSync(file, "utf8").split("\n") : [];
          const others = lines.filter((line) => line && !line.startsWith(name + ":"));
          fs.writeFileSync(file, [...others, name + ":" + bcrypt.hashSync(password, 10)].join("\n") + "\n", { mode: 0o600 });
        ' || exit 1
        unset ADMIN_PASSWORD
        exec verdaccio --config /verdaccio/conf/config.yaml --listen http://0.0.0.0:4873
    configs:
      - source: config
        target: /verdaccio/conf/config.yaml
    volumes:
      - storage:/verdaccio/storage

configs:
  config:
    content: |
      storage: /verdaccio/storage/data
      plugins: /verdaccio/plugins
      web:
        title: Verdaccio
      auth:
        htpasswd:
          file: /verdaccio/storage/htpasswd
          # Nobody signs up with npm adduser: users are lines of the file, which the administrator adds.
          max_users: -1
      uplinks:
        npmjs:
          url: https://registry.npmjs.org/
      # Only users who signed in install or publish, so the registry is no open mirror of npm.
      packages:
        '@*/*':
          access: $$authenticated
          publish: $$authenticated
          unpublish: $$authenticated
          proxy: npmjs
        '**':
          access: $$authenticated
          publish: $$authenticated
          unpublish: $$authenticated
          proxy: npmjs
      server:
        keepAliveTimeout: 60
      middlewares:
        audit:
          enabled: true
      log:
        type: stdout
        format: pretty
        level: http

volumes:
  storage:

compose.yamlSee it on GitHub