otty / dotfiles

All tools/Verdaccio

Verdaccio

verdaccio

A lightweight Node.js private proxy registry.

Detected by verdaccio | macOS, Linux, Windows |verdaccio.org

Sync it verdaccio.toml

Sync rules

What travels, what stays, what never leaves

Verdaccio in your home directory Every rule on this page, by file

uplinks.*.auth.token

Lifted into your secret store; the rest of the file syncs.

· storage/ Exclude

· .verdaccio-db Exclude

· htpasswd Never synced

· ~/.local/share/verdaccio/storage/ Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/verdaccio.tomlThe file this page is generated from

id = "verdaccio"

name = "Verdaccio"

homepage = "https://verdaccio.org"

description = "A lightweight Node.js private proxy registry."

icon = "SimpleIcons:verdaccio"

detect = ["verdaccio"]

# packages/config/src/config-path.ts in verdaccio's own source builds the list

# of candidate config directories, in order: the XDG one — `XDG_CONFIG_HOME`

# falling back to `$HOME/.config` — then `%APPDATA%` when the platform is

# win32, then a working-directory fallback for a config shipped beside a

# project. `CONFIG_FILE = 'config.yaml'` is the file name in every one of them.

# There is no `~/Library/Application Support` case, so a Mac takes the dotted

# XDG path too; XDG on Unix plus %APPDATA% on Windows is exactly [configHome].

paths = ["[configHome]/verdaccio/config.yaml"]

# https://verdaccio.org/docs/configuration — the config verdaccio generates on

# first run sets `storage: ./storage`, resolved against the config file's own

# folder, and the page says the `.verdaccio-db` database "location is based on

# the config.yaml folder location". Both hold published tarballs and registry

# bookkeeping, not configuration. config-path.ts moves storage to

# `$XDG_DATA_HOME/verdaccio/storage` on a machine that resolved the XDG path,

# so that spelling is named as well.

exclude = [

"[configHome]/verdaccio/storage/",

"[configHome]/verdaccio/.verdaccio-db",

"[xdgData]/verdaccio/storage/",

]

# The same default config sets `auth: htpasswd: file: ./htpasswd`, a file

# beside config.yaml. It is the registry's user database — one login and

# password hash per line — and nothing else, so it never syncs as content.

secret = ["[configHome]/verdaccio/htpasswd"]

# https://verdaccio.org/docs/uplinks documents the auth block on an uplink and

# says the `token` key is "not recommended by security concerns", offering

# `token_env` instead — which means a config that took the first option carries

# a registry token in the clear. The token is lifted out; `token_env`, which

# only names an environment variable, is left in place.

[[secret_paths]]

file = "[configHome]/verdaccio/config.yaml"

match = { key_path = ["uplinks.*.auth.token"] }

# No machine_lines. `storage` and `auth.htpasswd.file` are relative to the

# config file in the shipped default, so they read the same on every machine. A

# user who replaced one with an absolute path has made it machine-local, but

# holding the key back by default would strand the setting for everyone who

# did not.

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/verdaccio. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.