[{"data":1,"prerenderedAt":145},["ShallowReactive",2],{"seo-verification":3,"blog-verdaccio-private-npm-registry-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-verdaccio-private-npm-registry-vps-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":85,"ctaBody":86,"ctaButton":87,"ctaUrl":88,"relatedPosts":89},376,"verdaccio-private-npm-registry-vps",{"fr":12,"en":10,"ar":13,"es":14},"self-host-verdaccio-vps","استضافة-verdaccio-على-vps-مسجل-npm-خاص","alojar-verdaccio-en-un-vps-registro-npm-privado","Self-host Verdaccio on a VPS: private npm\u002Fyarn\u002Fpnpm registry","Deploy Verdaccio on your ServOrbit VPS: self-hosted private npm\u002Fyarn registry to proxy npmjs.org and host your internal JavaScript packages securely.",7,0,false,"2026-09-25T00:00:00+00:00","2026-09-25T23:43:02+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[28],{"id":17,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-verdaccio-vps-poster.svg",{"categorySlug":33,"appSlug":34},"development","verdaccio","Verdaccio is a lightweight open-source (MIT) Node.js npm registry. It acts as both a proxy to npmjs.org and a hosting server for your internal JavaScript packages. On a ServOrbit VPS, a single Docker container is all you need — under 128 MB RAM, no external database, and no domain required to get started. It is the practical choice for teams publishing internal libraries, maintaining stable CI pipelines, or working in air-gapped environments.",[37,41,51,54,73,76,79,82],{"type":38,"title":39,"body":40},"h2","Why self-host a private npm registry on your VPS","Three situations make a private npm registry essential. The first is managing internal JavaScript libraries: if you develop a design system, business utilities or API clients specific to your organization, publishing them to npmjs.org exposes them to the whole internet. A private registry keeps them behind your infrastructure, versioned and accessible only to your developers and pipelines.\n\nThe second is CI pipeline resilience. npmjs.org experiences outages several times a year, and each one can block your deployments for hours. Verdaccio caches every downloaded public package: the second `npm install` — in CI or locally — never hits the network again. Your builds speed up and become independent of the public registry's availability.\n\nThe third is offline or air-gapped work. Once the cache is pre-populated, Verdaccio serves all previously seen packages without an internet connection — useful for strict compliance environments, on-premise pipelines or demos without Wi-Fi.\n\nVerdaccio addresses all three in a single lightweight Docker container (under 128 MB RAM), with no external database and no complex configuration. It implements the full npm protocol, so npm, Yarn and pnpm connect with a single configuration parameter, without touching any dependency.",{"type":42,"title":43,"items":44},"ul","What you gain with self-hosted Verdaccio",[45,46,47,48,49,50],"Private packages under your namespace — publish internal libraries without exposing them to the public registry.","Local npmjs.org cache — your CI builds keep running even when the public registry is unavailable.","Zero external dependencies — a single Docker container, one volume, no database.","Under 128 MB RAM — runs on the smallest VPS without impacting other services.","Compatible with npm, Yarn, and pnpm — no client changes needed, just update the registry URL.","Offline mode — pre-warm the cache once, disconnect internet: builds stay reproducible.",{"type":38,"title":52,"body":53},"Requirements","Verdaccio is one of the lightest services you can deploy on a VPS. The prerequisite list is intentionally short: a VPS with 1 vCPU, 512 MB RAM (Verdaccio uses under 128 MB in normal operation) and Docker installed. No domain is required to start — you access the registry via an SSH tunnel from your workstation or a CI runner.\n\nFor permanent team or hosted CI pipeline access, attach a domain from your ServOrbit dashboard: nginx will proxy it over HTTPS automatically. Verdaccio works equally well behind this reverse proxy, and the TLS certificate is managed by ServOrbit without any action on your part.\n\nFor package storage, plan disk space proportional to your usage: public packages cached from npmjs.org and your private packages accumulate in a persistent Docker volume. For a team of 5 to 10 developers, a few gigabytes cover most JavaScript projects.",{"type":55,"title":56,"steps":57},"steps","Deploy Verdaccio on your ServOrbit VPS",[58,61,64,67,70],{"title":59,"body":60},"Order from the ServOrbit Marketplace","From your ServOrbit client area, install Verdaccio in one click from the Marketplace: select the Development category, choose Verdaccio, and confirm your order. The Docker container starts automatically on your VPS with a built-in healthcheck. You will receive a notification as soon as the service is operational, with the assigned exposure port.",{"title":62,"body":63},"Connect via SSH tunnel","Without a configured domain, open an SSH tunnel from your local machine: `ssh -L 4873:127.0.0.1:\u003Cport> root@\u003Cvps-ip>`. Then point npm at the tunnel: `npm set registry http:\u002F\u002Flocalhost:4873`. For Yarn 2+ (Berry), add `npmRegistryServer: \"http:\u002F\u002Flocalhost:4873\"` to your `.yarnrc.yml`. For pnpm: `pnpm config set registry http:\u002F\u002Flocalhost:4873`. These settings can be applied globally (`~\u002F.npmrc`) or per project (`.npmrc` at the repository root).",{"title":65,"body":66},"Create your first account","Run `npm adduser --registry http:\u002F\u002Flocalhost:4873`. Enter a username, password and email address. This first user becomes the registry administrator with full read and publish rights. You can create additional accounts with the same command — each developer gets their own credentials and access token.",{"title":68,"body":69},"Publish your first private package","In your package directory, run `npm publish --registry http:\u002F\u002Flocalhost:4873`. Make sure `package.json` contains a `name` field with your private scope (e.g. `@your-org\u002Fmy-package`) to distinguish it from public packages. Verify the publication at `http:\u002F\u002Flocalhost:4873`: your package appears in the list with its version number. It is now available to any authenticated developer or CI pipeline.",{"title":71,"body":72},"Attach a domain for permanent access","From your ServOrbit client area, attach a domain or subdomain to your VPS. nginx will automatically proxy Verdaccio over HTTPS. Update your global `.npmrc` (`registry=https:\u002F\u002Fverdaccio.your-domain.com`) or the CI environment variable `NPM_CONFIG_REGISTRY`. Your GitHub Actions, GitLab CI or other runners can now access the registry without an SSH tunnel.",{"type":74,"body":75},"tip","For permanent team access, attach a domain from your ServOrbit dashboard. nginx automatically proxies Verdaccio over HTTPS — set your global `.npmrc` (`registry=https:\u002F\u002Fverdaccio.your-domain.com`) or define `NPM_CONFIG_REGISTRY` in your CI environment variables.",{"type":38,"title":77,"body":78},"Configure scopes and proxy rules","By default, Verdaccio applies a single rule: every package is first searched locally, then proxied to npmjs.org if absent. This rule works for getting started, but most teams want to refine behavior by scope.\n\nConfiguration lives in `config.yaml`, accessible from the Docker volume (`verdaccio-storage`). The `packages:` section defines rules by name pattern. For a private scope (`@acme\u002F*`), you can disable the proxy to npmjs.org (`proxy: ''`) and allow only authenticated users to read and publish. For all other packages (`**`), you leave the proxy to `npmjs` active.\n\nMinimal scope configuration example:\n```yaml\npackages:\n  '@acme\u002F*':\n    access: $authenticated\n    publish: $authenticated\n  '**':\n    access: $all\n    proxy: npmjs\n```\n\nAfter modification, restart the container: `docker compose restart verdaccio`. The configuration is applied without reloading the package database. This approach ensures your private packages never reach npmjs.org, even in case of a configuration error.",{"type":38,"title":80,"body":81},"CI\u002FCD pipeline integration","Using Verdaccio in your CI\u002FCD pipelines brings two key benefits: build stability (independence from npmjs.org) and access to private packages from runners.\n\nFor **GitHub Actions**, set the environment variable in your workflow:\n```yaml\njobs:\n  build:\n    env:\n      NPM_CONFIG_REGISTRY: https:\u002F\u002Fverdaccio.your-domain.com\n      NPM_CONFIG_\u002F\u002Fverdaccio.your-domain.com\u002F:_authToken: ${{ secrets.VERDACCIO_TOKEN }}\n```\n\nFor **GitLab CI**, the equivalent syntax goes in the `variables:` section of your `.gitlab-ci.yml`. The access token is obtained with `npm token create --registry https:\u002F\u002Fverdaccio.your-domain.com` from any Verdaccio user account.\n\nFor **public package caching only** (no private packages), you can configure Verdaccio as a npmjs.org mirror in a dedicated runner Docker image. Packages are downloaded once by the first build, then served from cache for all subsequent builds — `node_modules` installation drops from 30–60 seconds to 2–5 seconds.",{"type":38,"title":83,"body":84},"Security and access control","By default, Verdaccio uses its own authentication system based on an `htpasswd` file. Accounts created with `npm adduser` are stored there with a bcrypt hash. This mechanism is sufficient for a small team, but Verdaccio also supports third-party authentication plugins: LDAP, GitLab, GitHub OAuth, Keycloak and others.\n\nFor **CI access tokens**, use `npm token create --registry https:\u002F\u002Fverdaccio.your-domain.com` rather than storing a plain-text password. Tokens can be revoked individually without affecting other users.\n\nOn ServOrbit, Verdaccio is bound to `127.0.0.1` and exposed only through the nginx reverse proxy. Port 4873 is never directly accessible from the internet — nginx adds TLS, and only the proxied domain responds on port 443. For maximum security, enable mandatory read authentication (`access: $authenticated` in `config.yaml`) if your registry contains sensitive packages. By default, Verdaccio allows anonymous reading — acceptable for a public package cache, but should be restricted for proprietary packages.","Deploy Verdaccio on a ServOrbit VPS","A ServOrbit VPS with pre-configured Docker, dedicated IPv4 and nginx included — deploy your private npm registry in minutes, without server configuration.","Deploy my VPS","\u002Fmarketplace\u002Fdevelopment\u002Fverdaccio",[90,110,127],{"id":91,"slug":92,"slugs":93,"title":97,"excerpt":98,"readTime":99,"views":18,"isPinned":19,"publishedAt":100,"updatedAt":101,"category":102,"categories":107,"featuredImage":29,"bgImage":30,"posterImage":109,"relatedSolution":29},202,"securing-your-npm-ci-supply-chain-after-asyncapi",{"fr":94,"en":92,"ar":95,"es":96},"securiser-chaine-approvisionnement-npm-ci","تأمين-سلسلة-توريد-npm-في-ci-بعد-حادثة-asyncapi","proteger-la-cadena-de-suministro-npm-tras-asyncapi","Securing Your npm CI Supply Chain After AsyncAPI","Lockfile policy, hash verification, SLSA provenance and automated SCA: how to harden your CI pipeline after the AsyncAPI incident of July 2026.",4,"2026-08-01T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":99,"name":103,"slug":104,"color":105,"icon":106},"Development","developpement","bg-warning\u002F10 text-warning","dev",[108],{"id":99,"name":103,"slug":104,"color":105,"icon":106},"\u002Fblog\u002Fcovers\u002Fsecuriser-chaine-approvisionnement-npm-ci-poster.svg",{"id":111,"slug":112,"slugs":113,"title":117,"excerpt":118,"readTime":119,"views":18,"isPinned":19,"publishedAt":120,"updatedAt":101,"category":121,"categories":122,"featuredImage":29,"bgImage":30,"posterImage":124,"relatedSolution":125},74,"host-gitea-on-your-own-vps",{"fr":114,"en":112,"ar":115,"es":116},"heberger-gitea","استضافة-gitea-على-خادم-vps-الخاص-بك","alojar-gitea-en-un-vps","Host Gitea on your own VPS in 2026","Deploy Gitea on a VPS with Docker and SSL. Full guide: installation, migration to Forgejo v16 and governance comparison.",8,"2026-04-07T00:00:00+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},[123],{"id":17,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fheberger-gitea-poster.svg",{"categorySlug":33,"appSlug":126},"gitea",{"id":128,"slug":129,"slugs":130,"title":134,"excerpt":135,"readTime":136,"views":137,"isPinned":19,"publishedAt":138,"updatedAt":101,"category":139,"categories":140,"featuredImage":29,"bgImage":30,"posterImage":142,"relatedSolution":143},311,"self-host-onedev-git-cicd-and-kanban-in-one-container",{"fr":131,"en":129,"ar":132,"es":133},"heberger-onedev-vps","onedev-على-vps-git-وcicd-وkanban-في-حاوية-واحدة","onedev-en-vps-git-cicd-y-kanban-autoalojados","Self-Host OneDev: Git, CI\u002FCD and Kanban in One Container","Deploy OneDev on your VPS: private Git forge, visual CI\u002FCD pipelines and Kanban boards. One container, no per-developer billing.",6,2,"2026-08-28T00:00:00+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},[141],{"id":17,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fheberger-onedev-vps-poster.svg",{"categorySlug":33,"appSlug":144},"onedev",1790385816949]