If you are building micro services, you really would want to share common utility code between them. While copy pasting is not a solution, you can create private npm packages and use them into your services. As you know theoretical micro services concepts are not quiet possible to implement and often comes with unnecessary overhead. I create isolated utility libraries as npm packages and make them available across micro services. Let’s see how I create them and configure the npmrc/yarnrc files to use private packages through a private registry together with public packages.

I am going to use Verdaccio for the private registry server, note that this article is NOT on how to use verdaccio but to share my configurations which work well across my development team and all the services in the project.

Table of Contents

  1. Benefits
  2. Installation
  3. Setup Config file
  4. Generate Credentials
    1. Start Verdaccio Server
    2. Create Admin User Credential
    3. Create Dev User Credential
  5. Setup package to use private registry
    1. Create .npmrc file
    2. Publish the package
  6. Setup Project to use private package
  7. Disable new user registration

Benefits

  1. Easy, Read only package sharing across the development team
  2. Integration with CI/CD pipelines
  3. Developers in the team can make PR for changes in the packages
  4. Single Admin access to the registry server (can be multiple users as needed)

Installation

We will install the Verdaccio server on a VM and configure the server and later modify the configurations for the security. You can setup the registry server on an EC2 instance or a free Azure App Service Plan. I tried modifying the Verdaccio source to run on AWS Lambda, but it looks impossible because of the Lambda limitations, I will leave this topic for may be another article. Let me know in the comments below if you are able to deploy Verdaccio to Lambda.

On any server with SSH connection. Let’s install the server first.

1
npm install --global verdaccio

After the installation, create a directory where you are willing to store the registry config, models and db files which are generated by Verdaccio.

1
2
mkdir verdaccio
cd verdaccio

Setup Config file

Create a config.yml file in this folder with the below config, this config file contains the details on the auth plugin, the group of users which will be able to access the server and read or write permissions to the packages. More on Verdaccio config.

1
2
touch config.yml
nano config.yml

Paste the below content into the file. Verdaccio server considers usernames registered as group names as well. This config file provides read and write access to the group/username admin and read permission to the user dev. We will generate credentials for these users in the next steps.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
storage: ./storage
auth:
  htpasswd:
    file: ./htpasswd
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  "@*/*":
    access: admin dev
    publish: admin
    proxy: npmjs
  "**":
    proxy: npmjs
logs:
  - { type: stdout, format: pretty, level: http }
listen:
  - 0.0.0.0:80

Generate Credentials

We can now start the server to generate the credentials. Follow the below steps to create credentials for admin and dev user.

Start Verdaccio Server

Verdaccio server can be started using the command line option to use the config file we just created.

1
verdaccio --config ./config.yaml

The server now should be available on the port 80 on the server IP, you can visit the server IP and see the Verdaccio application with 0 packages available.

Create Admin User Credential

Run below command from a new terminal session to register a new user and generate the credentials.

1
npm adduser --registry=http://SERVER_HOST_NAME or IP

Enter the username as admin when prompted and enter a password. The user will be generated on the server and credentials will be available in .npmrc file in the home directory. We will copy this credential and keep it safe for the admin user.

Run this command to print the content of npmrc file

1
cat ~/.npmrc

The content of the file will look like the one bellow. Copy the authToken value from the below file prefixed with the corresponding SERVER_HOST of the Verdaccio server. Keep this token safe, we will use this later for pushing npm packages to the server.

1
//SERVER_HOST_NAME/:_authToken="QjdrS40fxMUakbWPLtdkiw=="

Create Dev User Credential

Run below command from a new terminal session to register another user.

1
npm adduser --registry=http://SERVER_HOST_NAME or IP

Enter username as Dev when prompted and enter the password. The previous token will be replaced with a new token. Follow the same steps as above to get the auth token for the username Dev and keep it safe for later use.

Setup package to use private registry

We will use the admin auth token to push the packages to the Verdaccio server we just setup. Note that only admin user can push the packages as per our configuration. Keep the admin auth token handy for the next steps.

Create .npmrc file

Create a .npmrc file at the root of the package which needs to be pushed to the server. Paste in the below line in the file.

1
//SERVER_HOST_NAME/:_authToken="copied_admin_auth_token_here"

Publish the package

The package.json file should be updated with the package name to use the private package naming convention - scoped naming, eg. @commpany/package-name. Now run the below command to publish the the package to the private registry we just created. This file should not be committed to the source to avoid sharing the token with other team members, as this token can be used to override the packages and allows to publish any new packages to the server.

1
npm publish --registry http://SERVER_HOST_NAME

Setup Project to use private package

We need to now add the .npmrc file or .yarnrc file which to the root of the project. We will use the Dev user token in this file to provide read access to the packages for installation. This file can be committed to the source as it only provides the read access. It is just like sharing the source code with the team members hence nothing to worry about sharing the Dev token.

Add below content to the .npmrc file to have project install the scoped packages.

1
2
//SERVER_HOST_NAME/:_authToken="copied_dev_auth_token_here"
@company:registry=http://SERVER_HOST_NAME

Disable new user registration

Our Setup is now completed and we can now disable the new registration to the Verdaccio server to restrict others from using the server. Update the htpasswd section to disable new user registration as below.

1
2
3
4
5
---
htpasswd:
  file: ./htpasswd
  max_users: -1   // <-- Disable user registration
---

We are done with the setup now, you can follow the Verdaccio config to setup https/SSL for secure connection. Let me know your thoughts about this and share your setup as well that I should consider trying. Thanks for reading!