Connect package managers

Depsilo proxies 14 standard ecosystems plus Docker’s separate OCI /v2/ route: 15 install surfaces. Every client shares the workflow and rules on this page; pick the matching ecosystem from the sidebar for its exact configuration.

For developer machines and CI, start with Shared dependency caching to choose where the instance runs. Reusing Rust or C/C++ build outputs has a separate Compile cache setup from the dependency download cache covered here.

Prefer the configuration shown in the Portal

Select an ecosystem and package manager in the Depsilo Portal to get configuration generated for the current address. The Portal only displays and copies instructions; it does not modify your machine. Configure only the clients your project uses, and keep the previous settings as a rollback path.

General workflow

1. Check that the service is reachable

   curl -fsS http://localhost:23333/ready

   The examples assume http://localhost:23333. For a LAN address, reverse proxy, HTTPS, or custom port, replace the complete origin with an address reachable from the client. Opening the Portal in your browser does not mean a CI runner or container can use the same localhost.

2. Configure one client

   Prefer command, project, or project virtualenv settings, with an explicit scope. Back up existing user- or system-level configuration before changing it. Merge the target settings and preserve other fields. Each ecosystem page lists its endpoint, examples, and validation settings to keep.

3. Make a real request

   Run the client’s request and match the time, ecosystem, package, and status in Admin Access logs. Metadata, indexes, and artifacts are separate requests. A client’s local cache can avoid downloads, so a successful install alone does not establish a server cache hit.

4. Verify artifact caching independently

   Follow Verify caching to download the same artifact twice and inspect its matching artifact logs. That guide uses an npm tarball; other ecosystems need their own package-file records. Even the first request can already be a hit; use the logs to establish whether it reached upstream.

HTTP and HTTPS need different trust settings

This site’s examples add trusted-host, unsafeHttpWhitelist, secure-http = false, insecure-registries, and insecure = true only for plaintext HTTP. Valid HTTPS needs no such exception for Depsilo. When merging or removing settings, preserve existing configuration for other sources.

Ecosystem index

Ecosystem	Common clients	Server route	Configuration
Python (PyPI)	pip · uv · Poetry · Pipenv · PDM	/pypi/simple/	Configure Python
Node.js (npm)	npm · pnpm · Yarn · Bun	/npm/	Configure Node.js
Go Modules	go (GOPROXY)	/go/	Configure Go
Rust (Cargo)	cargo	/crates/	Configure Rust
Java (Maven)	Maven · Gradle	/maven/	Configure Java
Ruby (RubyGems)	Bundler · gem	/rubygems/	Configure Ruby
PHP (Composer)	composer	/composer/	Configure PHP
.NET (NuGet)	dotnet · NuGet	/nuget/v3/index.json	Configure .NET
Conda	conda	/conda/pkgs/…	Configure Conda
R (CRAN)	R	/cran/	Configure CRAN
Debian / Ubuntu (APT)	apt	/apt/debian, /apt/ubuntu	Configure APT
Alpine	apk	/alpine/	Configure Alpine
Helm	helm	/helm/	Configure Helm
Hugging Face	hf · Transformers	/huggingface	Configure Hugging Face
Docker OCI	Docker · containerd · Podman	/v2/	Configure Docker OCI

The Docker registry and Hugging Face upstreams are not created by the first-run Setup Wizard. Add their server-side configuration before using those routes; see the matching page.

Verify and roll back

• Confirm the request path, then follow the artifact verification steps to check the server cache. Repeated installs, metadata hits, and client caches cannot substitute for artifact hit records.
• Match the request time, ecosystem, package, status, and hit result in Admin Access logs. An artifact that was already cached can be a hit on the first download of this run.
• Record the previous registry, index, or sources and the configuration scope. Roll back in that scope, remove only entries you added, and preserve other settings without adding a parallel public fallback.
• Inside containers and remote hosts, localhost points at the container itself. Use the Depsilo hostname or IP that the client can actually reach.

If requests bypass Depsilo, return 451, or fail authentication, see Troubleshooting.