The following guide is a list of the best practices collected and that we usually recommend to all users. Do not take this guide as mandatory, you might pick some of them according your needs.
Feel free to suggest your best practices to the Verdaccio community.
It is recommended that you define a prefix for your private packages, for example
local-* or scoped
@my-company/*, so all your private things will look like this:
yaml packages: '@my-company/*': access: $all publish: $authenticated 'local-*': access: $all publish: $authenticated '@*/*': access: $all publish: $authenticated '**': access: $all publish: $authenticated
Always remember, the order of packages access is important, packages are matched always top to bottom.
如果一些包没有在存储里，服务器将试着从npmjs.org中取它。 如果npmjs.org坏了，它会假装没有其他的包存在, 并起到缓存包的作用。 Verdaccio will download only what's needed (requested by clients), and this information will be cached, so if client will ask the same thing second time, it can be served without asking npmjs.org for it.
If you successfully request
firstname.lastname@example.org from this server once, you'll be able to do it again (with all it's dependencies) anytime even if npmjs.org is down. But say
email@example.com will not be downloaded until it's actually needed by somebody. And if npmjs.org is offline, this server would say that only
firstname.lastname@example.org (only what's in the cache) is published, but nothing else.
If you want to use a modified version of some public package
foo, you can just publish it to your local server, so when your type
npm install foo, it'll consider installing your version.
You want to create a separate fork and stop synchronizing with public version.
如果您希望这么做，您应该修改配置文件，这样verdaccio将不再向npmjs提出此包的请求。 Add a separate entry for this package to
proxylist and restart the server.
packages: '@my-company/*': access: $all publish: $authenticated # comment it out or leave it empty # proxy:
When you publish your package locally, you should probably start with version string higher than existing one, so it won't conflict with existing package in the cache.
In order to avoid version conflicts, you should use a custom pre-release suffix of the next patch version. For example, if a public package has version 0.1.2, you can upload
npm version 0.1.3-my-temp-fix npm publish --tag fix --registry http://localhost:4873
This way your package will be used until its original maintainer updates his public package to
The security starts in your environment, for such thing we totally recommend read 10 npm Security Best Practices and follow the recommendation.
By default all packages are you publish in Verdaccio are accessible for all public, we totally recommend protect your registry from external non authorized users updating
access property to
packages: '@my-company/*': access: $authenticated publish: $authenticated '@*/*': access: $authenticated publish: $authenticated '**': access: $authenticated publish: $authenticated
That way, nobody will take advantage of your registry unless it's authorized and private packages won't be displayed in the User Interface.
email@example.com the tokens have no expiration date. For such reason we introduced in the next
firstname.lastname@example.org the JWT feature PR#896
security: api: jwt: sign: expiresIn: 15d notBefore: 0 web: sign: expiresIn: 7d
Using this configuration will override the current system and you will be able to control how long the token will live.
Using JWT also improves the performance with authentication plugins, the old system will perform an unpackage and validating the credentials in each request, while JWT will rely on the token signature avoiding the overhead for the plugin.
As a side note, at npmjs the token never expires.