Connect package managers

These examples target Depsilo v0.9.4 and assume the service is available at http://localhost:23333. If you open Depsilo through a LAN address, reverse proxy, HTTPS, or a custom port, replace the complete origin in each example with the URL you use to open the Portal.

Prefer the configuration shown in the Portal

Select an ecosystem and package manager in the Depsilo Portal to get configuration generated for the current address. The Portal only displays and copies instructions; it does not modify your machine. Configure only the clients your project uses, and keep the previous settings as a rollback path.

General workflow

1. Check that the service is reachable

   curl -fsS http://localhost:23333/ready

2. Configure one client

   Choose the matching ecosystem below. Prefer project-scoped configuration. Back up an existing file before changing user- or system-level configuration.

3. Make a real request

   The first request is normally a MISS. Repeat the same request, then use Admin Access logs to confirm that it reached Depsilo and that the second request can be served as a cache hit.

HTTP and HTTPS need different trust settings

trusted-host, unsafeHttpWhitelist, secure-http = false, insecure-registries, and insecure = true are exceptions for plain HTTP only. Omit them when Depsilo is served over HTTPS.

Client configuration

Python / Node

pip

For focused pip, uv, and Poetry guidance, go directly to Configure Python.

These commands update pip’s user-level configuration:

pip config set global.index-url http://localhost:23333/pypi/simple/
# Plain HTTP only:
pip config set global.trusted-host localhost:23333

pip install --dry-run --index-url http://localhost:23333/pypi/simple/ six

Do not add a public source as an automatic extra-index-url fallback. pip considers candidates from multiple indexes together, which can bypass a Depsilo policy decision. uv, Poetry, Pipenv, and PDM use the same /pypi/simple/ endpoint; select the specific client in the Portal for its project-scoped configuration.

npm, pnpm, Yarn, and Bun

npm config set registry http://localhost:23333/npm/
npm config get registry
npm view --registry=http://localhost:23333/npm/ is-number version

npm and pnpm can both use a project or user .npmrc:

.npmrc

registry=http://localhost:23333/npm/

Yarn 2+ uses npmRegistryServer, while Bun uses [install].registry in bunfig.toml. Their server route is still /npm/.

Go / Rust

Go Modules

go env -w GOPROXY=http://localhost:23333/go/,direct
go env GOPROXY

Keep GOSUMDB enabled so Go continues to verify public module checksums.

direct is not outage failover

The comma form, ,direct, advances only when the preceding proxy returns HTTP 404 or 410. It does not fall back when Depsilo is unreachable. Do not change it to |direct: the pipe form can also continue after a 451 policy response and bypass enforcement.

To make a temporary request without changing persistent configuration:

GOPROXY=http://localhost:23333/go/ go list -m -versions rsc.io/quote

Cargo

Cargo must replace crates.io with Depsilo. Merely adding a named registry does not change the default source.

~/.cargo/config.toml

[source.crates-io]
replace-with = "depsilo"

[source.depsilo]
registry = "sparse+http://localhost:23333/crates/"

The sparse+ prefix is required. Depsilo serves Cargo at /crates/, not /cargo/.

cargo fetch

JVM

Maven

Maven has no general command-line option that overrides every remote repository, so configure a mirror:

~/.m2/settings.xml

<settings>
  <mirrors>
    <mirror>
      <id>depsilo</id>
      <url>http://localhost:23333/maven/</url>
      <mirrorOf>*</mirrorOf>
    </mirror>
  </mirrors>
</settings>

mvn help:effective-settings | grep depsilo

<mirrorOf>*</mirrorOf> routes every declared repository through Depsilo. If you need exclusions, express them explicitly instead of relying on an implicit public fallback.

Gradle

Use ~/.gradle/init.gradle for a machine-wide setting, or add the repository to the project’s repositories block:

~/.gradle/init.gradle

allprojects {
  repositories {
    maven { url "http://localhost:23333/maven/" }
  }
}

gradle dependencies --refresh-dependencies

Ruby / PHP / .NET

RubyGems and Bundler

bundle config mirror.https://rubygems.org http://localhost:23333/rubygems/
bundle config get mirror.https://rubygems.org

Bundler writes to .bundle/config in the current project by default. Add --global only when you intend to change the user-level configuration.

Composer

composer config -g repo.packagist composer http://localhost:23333/composer/
# Plain HTTP only:
composer config -g secure-http false

composer diagnose

Composer may fall back from a rejected mirrored dist to its original dist URL. If every request must be enforced, also restrict direct client access to the original origin at the network layer.

NuGet / dotnet

dotnet nuget add source http://localhost:23333/nuget/v3/index.json -n depsilo
dotnet nuget list source

This command changes the user-level NuGet.Config. For a team project, place an equivalent NuGet.Config next to the solution and use <clear /> when you need to remove the default nuget.org source.

Data

Conda

~/.condarc

channels:
  - http://localhost:23333/conda/pkgs/main
  - http://localhost:23333/conda/pkgs/r
default_channels: []
repodata_use_zst: false

Anaconda channel paths must include pkgs/. default_channels: [] prevents an automatic fallback to repo.anaconda.com. repodata_use_zst: false avoids 404 responses from upstream mirrors that do not publish .zst metadata.

R / CRAN

~/.Rprofile

options(repos = c(CRAN = "http://localhost:23333/cran/"))

Helm

helm repo add depsilo http://localhost:23333/helm/
helm repo update
helm search repo depsilo | head

One Depsilo Helm upstream maps to one chart repository. The server-side upstream configuration, not a URL suffix, selects the chart source.

Hugging Face

export HF_ENDPOINT=http://localhost:23333/huggingface
hf download prajjwal1/bert-tiny --local-dir /tmp/bert-tiny

Continue to use your own HF_TOKEN for gated models. Responses carrying upstream credentials are not stored in the shared cache.

Initial Setup does not create a Hugging Face upstream

The v0.9.4 Setup Wizard does not generate a Hugging Face upstream. Before using this endpoint, add the server-side configuration from the config.example.toml shipped with v0.9.4 and restart Depsilo.

APT / OCI

APT

Depsilo is an APT reverse proxy. Replace the repository URLs in your sources file; do not configure Acquire::http::Proxy. This is a Debian 13 “trixie” example. Use the correct suite for another release. Ubuntu uses /apt/ubuntu and its own codename.

/etc/apt/sources.list.d/debian.sources

Types: deb
URIs: http://localhost:23333/apt/debian
Suites: trixie trixie-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://localhost:23333/apt/debian-security
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Back up and edit the existing sources deliberately. Do not run a cross-distribution sed -i command blindly. Depsilo passes signed repository content through unchanged, so APT performs its normal GPG verification.

sudo apt update
apt-cache policy | head

Alpine apk

Replace v3.20 with the major/minor branch matching /etc/alpine-release:

/etc/apk/repositories

http://localhost:23333/alpine/v3.20/main
http://localhost:23333/alpine/v3.20/community

Docker OCI

Merge these keys into the existing daemon JSON instead of overwriting unrelated settings:

/etc/docker/daemon.json

{
  "registry-mirrors": ["http://localhost:23333"],
  "insecure-registries": ["localhost:23333"]
}

The mirror URL must be the Depsilo service root. Docker requests /v2/ itself; do not append /docker/. insecure-registries is for HTTP only. Restart Docker after changing the daemon configuration.

Initial Setup does not create a Docker registry

The v0.9.4 Setup Wizard does not generate Docker registry configuration. Add the server-side registry block from the config.example.toml shipped with v0.9.4 and restart Depsilo before changing Docker, containerd, or Podman clients.

Verify and roll back

• Make the same real dependency request twice. The first request normally reaches an upstream; the second is the meaningful cache-hit check.
• Confirm the ecosystem, package, status, and hit result in Admin Access logs. A successful client install alone does not prove the request used Depsilo.
• Record the original registry, index, or sources before changing it. Restore that value to roll back instead of adding a parallel public fallback.
• localhost inside a container or remote machine refers to that client itself. Replace it with a Depsilo hostname or IP that the client can actually reach.