Skip to main content

Awọn iṣeṣi to Darajulọ

The following guide is a list of the best practices collected and that we usually recommend to all users. Do not take this guide as mandatory, you might pick some of them according your needs.

Ma se mikan lati dabaa awọn iṣesi to dara julọ pẹlu awujọ Verdaccio naa.

Ibi iforukọsilẹ Ikọkọ

O se afikun awọn olumulo ati ki o ṣakoso irufẹ awọn olumulo ti o le wọle si irufẹ awọn akopọ.

It is recommended that you define a prefix for your private packages, for example local-* or scoped @my-company/*, so all your private things will look like this: local-foo. This way you can clearly separate public packages from private ones.

 yaml
packages:
'@my-company/*':
access: $all
publish: $authenticated
'local-*':
access: $all
publish: $authenticated
'@*/*':
access: $all
publish: $authenticated
'**':
access: $all
publish: $authenticated

Seranti nigbagbogbo, aato ti iwọlesi ti akojọ se pataki, awọn akojọ ma n jẹ sisopọ lati oke si isalẹ nigbagbogbo.

Lilo awọn akopọ gbogbogbo lati npmjs.org

If a package doesn't exist in the storage, the server will try to fetch it from npmjs.org. If npmjs.org is down, it serves packages from the cache pretending that no other packages exist. Verdaccio will download only what's needed (requested by clients), and this information will be cached, so if the client requests the same thing a second time it can be served without asking npmjs.org for it.

Apẹẹrẹ:

If you successfully request express@4.0.1 from the server once, you'll be able to do it again (with all of it's dependencies) any time, even if npmjs.org is down. Though note that express@4.0.0 will not be downloaded until it's actually needed by somebody. And if npmjs.org is offline, the server will say that only express@4.0.1 (what's in the cache) is published, but nothing else.

Override public packages

Ti o ba fẹ lo diẹ ninu awọn akopọ ti gbangba ti ẹya to ti ni ayipada foo, o le ṣe atẹjade rẹ si olupese ibilẹ rẹ, nitorina nigbati iru npm install foo rẹ, o ma gbero fifi ti iwọ sori ẹrọ.

Awọn aṣayan meji lo wa nibi:

  1. O fẹ ṣẹda fork to daduro ati ki o da imuṣiṣẹpọ pẹlu gbogbogbo duro.

    If you want to do that, you should modify your configuration file so Verdaccio won't make requests regarding this package to npmjs anymore. Add a separate entry for this package to config.yaml and remove npmjs from proxy list and restart the server.

    awọn akopọ:
    '@my-company/*':
    access: $all
    publish: $authenticated
    # comment it out or leave it empty
    # proxy:

    Nigbati o ba ṣe atẹjade akopọ rẹ ni ibilẹ, o yẹ ki o bẹrẹ pẹlu ẹya okun ti o ga ju eyi ti o wa tẹlẹ lọ, nitori ko ma ba tako akopọ to ti wa ninu apo iranti tẹlẹ.

  2. O fẹ lati lo ẹya ti ara rẹ fun igba diẹ, ṣugbọn pada si ti gbogbogbo ni kete ti o ba ti wa ni imudojuiwọn.

    In order to avoid version conflicts, you should use a custom pre-release suffix of the next patch version. For example, if a public package has version 0.1.2, you can upload 0.1.3-my-temp-fix.

     npm version 0.1.3-my-temp-fix
    npm --publish --tag fix --registry http://localhost:4873

    Ni ọna yii akopọ rẹ ma jẹ lilo titi ti oulowo olutọju rẹ yoo fi ṣe imudojuiwọn akopọ gbogbogbo ti ara rẹ si 0.1.3.

Aabo

Security starts in your environment.

Additional reading:

Strong package access with $authenticated

By default all packages you publish in Verdaccio are accessible for all users. We recommend protecting your registry from external non-authorized users by updating the access property of your packages to $authenticated.

awọn akopọ:
'@my-company/*':
access: $authenticated
publish: $authenticated
'@*/*':
access: $authenticated
publish: $authenticated
'**':
access: $authenticated
publish: $authenticated

Ni ọna yẹn, ẹnikẹni ki yoo lo anfani ti ibi iforukọsilẹ rẹ ayafi ti o ba gba aṣẹ atipe awọn akojọ ikọkọ ki yooo han ni Intafeesi Olumulo naa.

Remove proxy to increase security at private packages

Lilo ** HTTPS** jẹ igbaniyanju to wọpọ, fun idi eyi a ṣe igbaniyanju lati ka abala SSL lati mu ki Verdaccio ni aabo tabi lilo HTTPS alayipada aṣoju ikọkọ lori ti Verdaccio.

packages:
"@*/*":
access: $authenticated
publish: $authenticated
proxy: npmjs
"**":
access: $authenticated
publish: $authenticated
proxy: npmjs

This means, if a private packaged eg: @my-company/auth is published locally, the registry will look up at the public registry. If your intention is fully protection, remove the proxy property from your configuration, for instance:

packages:
"@my-company/*":
access: $authenticated
publish: $authenticated
unpublish: $authenticated
"@*/*":
access: $authenticated
publish: $authenticated
proxy: npmjs
"**":
access: $authenticated
publish: $authenticated
proxy: npmjs

Lilo iṣeto yii yoo ṣe atẹmọlẹ eto ti lọwọlọwọ yii atipe iwọ yoo le ṣakoso iye igba ti aami naa yoo fi wa laye.

Server

Secured Connections

Using HTTPS is a common recommendation. For this reason we recommend reading the SSL section to make Verdaccio secure, or alternatively using an HTTPS reverse proxy on top of Verdaccio.

Expiring Tokens

Since verdaccio@3.x the tokens have no expiration date. For such reason we introduced in the next verdaccio@4.x the JWT feature PR#896

security:
api:
jwt:
sign:
expiresIn: 15d
notBefore: 0
web:
sign:
expiresIn: 7d

Using this configuration will override the current system and you will be able to control how long the token will live.

Using JWT also improves the performance with authentication plugins. The old system will perform an unpackage and validate the credentials on every request, while JWT will rely on the token signature instead, avoiding the overhead for the plugin.

As a side note, be aware at npmjs and the legacy verdaccio token never expires** unless you invalidate manually.