Hacker News Reader

Comment by symlinkk | Hacker News Reader

I hate how there's no official way to run your own private NPM registry. So you have to either pay NPM or resort to third party solutions like verdaccio. It's such an obvious money grab by the NPM devs.

View on HN

They're running a business. They offer an inordinate amount of service totally free to millions of developers, and they make their actual client open-source for your pleasure. Is your argument they also have to go to the trouble of making their infrastructure easily self-hosted? How would they make the money to pay the lawyers to respond to the very legal threat this tweet is about without revenue?

Please, it's arbitrary to run a private PyPi repository, all you need is a web server and a certain folder structure. If you want, you can even host everything on a private S3 and use a tiny Nginx configuration to authenticate the requests on behalf of pip [1].

Private npm repositories are an entirely different beast, and like GP mentions, there is no great option here.

[1] https://www.guido.nyc/pypi-s3/

https://cloudsmith.io/l/npm-repository/ - no?

Potential users should be aware that the quoting in the shell commands on that page is faulty and requires attention.

Can you give an example? Not sure what you're referring to.

There are many ways to specify dependency except from central npm server: https://docs.npmjs.com/files/package.json#dependencies

That includes tarballs on http, git repos and even freaking local directories.

For companies where putting packages on smb mount is treated as non-enterprisey, npm have "npm enterprise" offering: https://www.npmjs.com/products/enterprise

Whats wrong w/ nexus? https://blog.sonatype.com/using-nexus-3-as-your-repository-p... All our devs have our group repo configured as default. Any publishing is done to our private repo (via CI only) and any public package is pulled through the proxy repo, this way all packages are cached in our private repo so when npm registry goes down / someone unpublishes (which happens/ed?) our CI server doesn't die.

Nexus is great, comes with an easy to use docker image - and also works as a Nuget repository and more.

Just put the package in a git repo like Github and point to it w/ package.json

EDIT - I see what you are saying - your own registry with browser and all.

Its not official, and not free, but GitLab can host NPM packages: https://about.gitlab.com/2019/01/22/gitlab-11-7-released/#np...

There's LOTS of solutions for your own NPM, not to mention you can use git over ssh or http(s)... there are proxies, self-publish software. Some of it open-source, other options not so much. IIRC, you can even run your own npm if you wanted to.

Gotta pay the bills somehow. I think that providing enterprise support is a very good way to do so. There is nothing compelling them to develop an official solution and a third-party one already exists. It looks like this is a good example of open source WAI.

JFrog has an open-core/OSS repo for NPM, I believe.

Reply on news.ycombinator.com