otty / apps

All apps/Verdaccio

Verdaccio

verdaccio

A lightweight Node.js private proxy registry.

Runs as verdaccio|macOS, Linux, Windows|verdaccio.org

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Verdaccio in your home directory Every rule on this page, by file

uplinks.*.auth.token

Lifted into your secret store; the rest of the file syncs.

· storage/ Exclude

· .verdaccio-db Exclude

· htpasswd Never synced

· ~/.local/share/verdaccio/storage/ Exclude

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/verdaccio/otty.tomlThe file this page is generated from

id = "verdaccio"

name = "Verdaccio"

homepage = "https://verdaccio.org"

description = "A lightweight Node.js private proxy registry."

icon = "SimpleIcons:verdaccio"

executables = ["verdaccio"]

[dotfiles]

# packages/config/src/config-path.ts in verdaccio's own source builds the list

# of candidate config directories, in order: the XDG one — `XDG_CONFIG_HOME`

# falling back to `$HOME/.config` — then `%APPDATA%` when the platform is

# win32, then a working-directory fallback for a config shipped beside a

# project. `CONFIG_FILE = 'config.yaml'` is the file name in every one of them.

# There is no `~/Library/Application Support` case, so a Mac takes the dotted

# XDG path too; XDG on Unix plus %APPDATA% on Windows is exactly [configHome].

paths = ["[configHome]/verdaccio/config.yaml"]

# https://verdaccio.org/docs/configuration — the config verdaccio generates on

# first run sets `storage: ./storage`, resolved against the config file's own

# folder, and the page says the `.verdaccio-db` database "location is based on

# the config.yaml folder location". Both hold published tarballs and registry

# bookkeeping, not configuration. config-path.ts moves storage to

# `$XDG_DATA_HOME/verdaccio/storage` on a machine that resolved the XDG path,

# so that spelling is named as well.

exclude = [

"[configHome]/verdaccio/storage/",

"[configHome]/verdaccio/.verdaccio-db",

"[xdgData]/verdaccio/storage/",

]

# The same default config sets `auth: htpasswd: file: ./htpasswd`, a file

# beside config.yaml. It is the registry's user database — one login and

# password hash per line — and nothing else, so it never syncs as content.

secret = ["[configHome]/verdaccio/htpasswd"]

# https://verdaccio.org/docs/uplinks documents the auth block on an uplink and

# says the `token` key is "not recommended by security concerns", offering

# `token_env` instead — which means a config that took the first option carries

# a registry token in the clear. The token is lifted out; `token_env`, which

# only names an environment variable, is left in place.

[[dotfiles.secret_paths]]

file = "[configHome]/verdaccio/config.yaml"

match = { key_path = ["uplinks.*.auth.token"] }

# No machine_lines. `storage` and `auth.htpasswd.file` are relative to the

# config file in the shipped default, so they read the same on every machine. A

# user who replaced one with an absolute path has made it machine-local, but

# holding the key back by default would strand the setting for everyone who

# did not.

[commands]

format = 1

label = "Start registry"

description = "Start the Verdaccio private npm registry with a chosen listen address and config file."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "docs"

kind = "manual"

url = "https://verdaccio.org/docs/cli"

revision = "2026-10-27"

evidence = """verdaccio --listen 4000 --config ./config.yaml

--listen / -l localhost:4873 7000 Protocol + host + port to listen on

--config / -c ~/.config/verdaccio/config.yaml ./config.yaml Location of the configuration file

--info / -i Print local environment information

--version / -v Show version information"""

[[commands.field]]

id = "listen"

label = "Listen address"

description = "Port, host:port or proto://host:port. Default localhost:4873."

type = "string"

option = ["--listen", "-l"]

suggestions = [{ value = "4873", label = "4873 (default port)" }, { value = "0.0.0.0:4873", label = "All interfaces" }]

sources = ["docs"]

[[commands.field]]

id = "config"

label = "Config file"

type = "path"

option = ["--config", "-c"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["docs"]

[[commands.field]]

id = "info"

label = "Print environment info and exit"

type = "boolean"

option = ["--info", "-i"]

sources = ["docs"]

[[commands.task]]

id = "start"

label = "Start the registry"

fields = ["listen", "config"]

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["listen", "config", "info"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/verdaccio. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.