Zoltan Kochan
7fb2bfab4a
Part of https://github.com/pnpm/tasks/issues/191. Wrong claims: - cli: drop the nonexistent `add-user --password` flag and document the terminal/stdin password read; `oci-gc --min-age` and `cache-gc --max-age` are the flags (the `-secs` forms are aliases); `--from` defaults to the `storage` key, not an internal field; `info` and `http` log the same access records; only global and server options have PNPR_* variables. - configuration: `packumentTtl` defaults to 5m; the minimal config now sets `auth.htpasswd.file`, and the auth section says accounts live in memory without it or a backend; grouped hosted registries default their org to `<ecosystem>~<name>`; the handshake is served for any surface; the pipeline surface also satisfies "something must be served"; add `package.update_maintainers` to the audit list. - tls-and-reverse-proxy: remove the invalid `publicUrl:` YAML key and the nonexistent `rate_limiting` setting. - backup-and-restore: `pnpr verify` hashes by default (`--check-hashes` does not exist, `--skip-hashes` skips only the hash comparison); `migrate-storage --verify` compares bytes. - webhooks: audit events do not cover publishes or token creation; the example uses a real action and the `actor` field. - cli: the `RUST_LOG` example keeps `pnpr::audit=info`. - install-acceleration: the `--public-url` host is exempt from the private-address refusal. - shared-side-effects-cache: `pnpm pipeline` publishes workspace-task artifacts. Missing facts: `routes.allowedPrivateNetworks`, the upstream `search` key and canonical `maxAge`, built-in `npm.jsr.io` route, relative path resolution, `log` defaults and `type`, `${VAR:-default}` substitution and the full secret-field list, `oci` defaults, `artifacts.quota` bounds, `migrate-storage` destination rules, `--osv false`, `--packument-ttl` default, S3 `forcePathStyle`/`allowHttp` defaults, grouped org layout, OIDC key table, container image section, `backend:` ignoring the htpasswd and token files. Duplicates and links: health probe bodies, reload procedure, and the resolver allowlist now link to their one home; broken `#secret` anchor fixed; links into the pnpm docs use absolute pnpm.io URLs. Stale history: drop "pnpr v1" and the per-paragraph "Since alpha.N" / "Since pnpm 12.x" prefixes, and the contributor-only extensibility text. Also corrects the `as_filter_directive` doc comment, which claimed `http` quiets the rest of the crate.
3.1 KiB
id, title, slug
| id | title | slug |
|---|---|---|
| introduction | Introduction | / |
pnpr is a pnpm-compatible registry server, written in Rust. It speaks the
npm registry protocol, so any npm-compatible client (pnpm, npm, yarn) can talk to
it. It hosts your own packages and proxies upstream registries such as
registry.npmjs.org, with its own authentication and access controls. It plays roughly
the role verdaccio plays in the JavaScript ecosystem.
One instance can serve more than npm. It also speaks the Cargo and Python protocols and the OCI distribution API, so a workspace that ships a package, a crate, a Python distribution, and an image can publish all four in one transaction. Users can sign in through OpenID Connect.
Every registry origin pnpr serves is a declared registry that claims the package names it serves, and a router resolves each package name to exactly one origin. There is no cross-origin fall-through, which closes dependency-confusion attacks by construction.
pnpr lives in the pnpm monorepo under
pnpr/.
:::caution Experimental
pnpr is experimental and still in active development. Its behavior, configuration, and APIs may change between releases.
:::
What you can use it for
- A private registry: host your organization's private packages, with per-package access and publish rules.
- A caching proxy: mirror an upstream registry (e.g. npmjs.org) to speed up installs and stay resilient to upstream outages.
- A credential gateway: hold one upstream registry token server-side and fan it out to a whole team through pnpr's own authentication, so clients never handle the upstream credential.
- An install accelerator: resolve a project's dependency graph server-side and hand pnpm a ready-to-use lockfile, for npm, Cargo, and Python dependencies alike. See Install acceleration.
- A container image registry: push and pull with
docker,podman, orskopeo, and cache pulls from Docker Hub and GHCR. See Container images. - A build cache: share a Cargo compilation cache
between CI and developer machines, and keep the
run records of
pnpm pipeline.
How it relates to pnpm
pnpr is a separate product from the pnpm CLI. The pnpm CLI installs packages on your machine; pnpr is a server you run to host and proxy them. You can use either one without the other, but they're designed to work well together, and pnpm can offload dependency resolution to a pnpr server to make installs faster.
License
pnpr is source-available, not open source. It is licensed under the PolyForm Shield License 1.0.0. You may run, modify, and self-host pnpr for any purpose except providing a product that competes with it. This is the only part of the pnpm monorepo that is not MIT licensed. See License for details.