mirror of
https://github.com/hanzoai/pkg.git
synced 2026-10-30 18:24:07 +00:00
zeekay
5d65910237
pkg.hanzo.ai serves packages; oci.hanzo.ai serves images and charts. Both sit on the same hanzoai/s3 object store.
87 lines
3.1 KiB
YAML
87 lines
3.1 KiB
YAML
# Hanzo Pkg — pkg.hanzo.ai, the self-hosted npm registry.
|
|
#
|
|
# verdaccio 5 with verdaccio-aws-s3-storage: every package tarball and
|
|
# metadata document lives in the `pkg` bucket on hanzoai/s3 (s3.hanzo.svc),
|
|
# the same store oci.hanzo.ai (containers) uses. Zero local disk.
|
|
#
|
|
# Credentials arrive as environment, never in this file:
|
|
# AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY <- k8s secret s3-credentials
|
|
# (KMS-synced, /hanzo-s3)
|
|
# /verdaccio/auth/htpasswd <- k8s secret pkg-auth
|
|
# (KMS-synced, /pkg htpasswd)
|
|
|
|
plugins: /verdaccio/plugins/node_modules
|
|
|
|
store:
|
|
aws-s3-storage:
|
|
bucket: pkg
|
|
region: us-east-1
|
|
endpoint: http://s3.hanzo.svc:9000
|
|
s3ForcePathStyle: true
|
|
|
|
auth:
|
|
htpasswd:
|
|
file: /verdaccio/auth/htpasswd
|
|
algorithm: bcrypt
|
|
# Registration closed: users are provisioned through KMS, not adduser.
|
|
max_users: -1
|
|
|
|
web:
|
|
title: Hanzo Pkg
|
|
# ABSOLUTE paths. verdaccio resolves a relative logo against the process CWD
|
|
# (/opt/verdaccio), finds nothing there, and drops the value to undefined — the
|
|
# page then renders logo:"" with no mark and no error. Given a path that exists
|
|
# it reads the file itself and publishes it at /-/static/<basename>.
|
|
# The mark is the white one because primary_color paints the header behind it.
|
|
logo: /verdaccio/web/hanzo-mark.svg
|
|
logoDark: /verdaccio/web/hanzo-mark.svg
|
|
# The tab icon is NOT the theme's static/favicon.ico. An app-level route for
|
|
# /-/static/favicon.ico answers first and streams whatever this names, falling
|
|
# back to the stock icon shipped inside verdaccio itself.
|
|
favicon: /verdaccio/web/favicon.ico
|
|
primary_color: '#000000'
|
|
# The stock footer signs the page "Powered by <upstream>" with its mark. This
|
|
# registry is ours; the footer carries no other content, so it goes.
|
|
showFooter: false
|
|
|
|
uplinks:
|
|
npmjs:
|
|
url: https://registry.npmjs.org/
|
|
cache: true
|
|
maxage: 30m
|
|
max_fails: 5
|
|
fail_timeout: 2m
|
|
# A REQUEST THAT NEVER ENDS IS WORSE THAN ONE THAT FAILS. Without this,
|
|
# verdaccio inherits no socket deadline: a half-open connection to npmjs
|
|
# leaves the client hanging forever rather than erroring, and `max_fails`
|
|
# never counts a fail because nothing ever failed. Measured that way —
|
|
# `/pnpm`, `/yarn`, `/lodash` and `/typescript` hung past 30s while
|
|
# `/react` and `/eslint`, already in S3, answered instantly, and the log
|
|
# showed the upstream request was never even issued for the stuck ones.
|
|
#
|
|
# It matters far beyond a slow install: every runner in the fleet sets
|
|
# COREPACK_NPM_REGISTRY to this host, so corepack cannot bootstrap pnpm
|
|
# while a metadata read hangs, and CI stops estate-wide on a 524.
|
|
timeout: 30s
|
|
|
|
packages:
|
|
'@*/*':
|
|
access: $all
|
|
publish: $authenticated
|
|
proxy: npmjs
|
|
'**':
|
|
access: $all
|
|
publish: $authenticated
|
|
proxy: npmjs
|
|
|
|
server:
|
|
keepAliveTimeout: 60
|
|
|
|
max_body_size: 200mb
|
|
|
|
middlewares:
|
|
audit:
|
|
enabled: true
|
|
|
|
log: { type: stdout, format: pretty, level: info }
|