A partner runs npm install against the registry you sent and gets 401—the private repo needs a token, and you will not hand them a Deploy Token. A zip over chat unblocks them once, but there is no version page and no copy-paste install command.
The public portal does one narrow job: after you mark a delivery HOSTED isPublic, visitors anonymously search on /explore, open the detail page, and copy credential-free install commands. It is the same data as the console—not a second downloads site. Private repos stay invisible; anonymous upload stays off. Sample host repo.anguskit.com (trust the console connection config).
Rule of thumb: Anonymous read-only, and only
isPublicrepos; dedicatedpublic-*HOSTED—no SNAPSHOT; writes use a Deploy Token; reads use the detail-page command; Docker—never hand-write/v2.
If the stack is not up yet, finish First run (or Install & deploy) first. Manual: Public Portal. Below: boundary, then the three-step enable path.
1. Boundary: what visitors never see
One rule: anonymous read-only, and only repositories explicitly marked public.
| Item | Rule |
|---|---|
| Visibility | Only isPublic=true repos and their artifacts |
| Private resources | Not searchable; portal cannot enumerate private repos |
| Writes | Upload/delete/config need login / token |
| Protocol pulls | Non-public repos still need credentials (token in password field) |
Do not mark day-to-day or SNAPSHOT repos public. Do not mark a GROUP public if it aggregates private HOSTED—visitors may reach coordinates they should not. Publish only the delivery HOSTED.
2. Why a dedicated public-* instead of flipping an existing repo
| Approach | Risk / benefit |
|---|---|
Flip internal npm-hosted to public |
Easy to leak SNAPSHOT, internal names, unscrubbed READMEs |
Dedicated public-npm / public-docker / public-raw
|
Delivery coords isolated; public-list audits stay simple |
Recommended: external deliverables → public HOSTED; internals stay on private HOSTED + GROUP. Layout: org ACL isolation.
3. What /explore shows
Entry: https://repo.anguskit.com/explore (header Explore jumps here; use the console’s http:// before TLS).
| Page | Path |
|---|---|
| Home | /explore |
| Public repos | /explore/repositories |
| Repo detail | /explore/repositories/{name} |
| Artifact search | /explore/artifacts |
| Artifact detail | /explore/artifacts/{repoName}/{packageName} |
Detail pages usually include versions, README, deps/files, license, and a vuln summary when scans exist—a summary is not “deep-scanned and cleared for release” (see admission scanning).
Install blocks are credential-free from the detail page, for example:
# npm
npm install @company/utils --registry https://repo.anguskit.com/npm/public-npm/
# Maven (coordinates from the detail page)
# <repository>…/maven/public-maven/</repository>
# Docker (never hand-write /v2 in the image name)
docker pull repo.anguskit.com/public-docker/myapp:1.4.0
# Raw
curl -O "https://repo.anguskit.com/raw/public-raw/my-app/1.0.0/my-app-1.0.0-linux-amd64.tar.gz"
Raw text/small media can preview online (~1 MB text / ~15 MB media auto-load); previews do not count as downloads. Anonymous users can read/download; signed-in users may favorite/subscribe (writes stay in the console).
4. Three steps + verify
-
Create a dedicated public HOSTED — e.g.
public-npm/public-raw/public-docker; set public (isPublic) in repo settings. -
Upload one release with a Deploy Token — token needs Write on that public repo (often
repod_prefix); do not put an Admin token in partner docs. See Deploy Token & ACL. Format publish: npm · Docker · Raw. -
Incognito-open
https://repo.anguskit.com/explore— find the repo/artifact; copy the detail install command and run it in a clean env.
After flipping public, the index may lag tens of seconds to a few minutes; wait and refresh before assuming failure, then re-check isPublic.
Checklist:
- [ ] Logged-out
/exploreshows the target repo - [ ] Private repo names do not appear in portal search
- [ ] Install command works in a clean env (or at least
curl -I/npm view/docker pull) - [ ] Anonymous upload is still rejected
- [ ] No SNAPSHOT coordinates on the public list
Three common uses
- Open-source / external SDK page — versions, README, install in one place.
-
Partner delivery — dedicated public HOSTED + share
/explore. - Intranet artifact store — portal only on the LAN to reduce reinvention.
5. After go-live
- Audit the public list regularly (Best practices).
- Links can stay stable while content follows the repo.
- Keep releases immutable on public repos; bump versions for fixes.
- Align binary paths with the Raw guide when shipping installers.
Error cheat sheet
| Symptom | Likely cause | Fix |
|---|---|---|
| Not in portal search | not public, or brief index lag | check isPublic; wait tens of seconds–minutes |
| Install command 401 | linked a private repo / wrong path | use the detail-page no-auth command |
| Upload 401 / 403 | missing Deploy Token or Write | create token bound to that public HOSTED |
| Docker pull fails | hand-written /v2 in the name |
remove /v2; match connection config |
| Partners still want zips | SNAPSHOT or unstable paths published | publish release coordinates only |
FAQ
Can the public repo accept anonymous uploads?
No. Public unlocks read only; writes always need auth (Deploy Token / login).
Should the whole registry be public by default?
No. Dedicated public HOSTED for deliverables; keep internal repos private.
Can I mark a GROUP public if it includes private members?
No. Only publish delivery HOSTED; a GROUP that aggregates private repos widens exposure.
Is the portal a second system?
No. Same instance and data; visibility follows the public flag.
Takeaways
- The portal is the last mile of distribution, not a second downloads site.
- Dedicated public HOSTED only; never SNAPSHOT, secrets, or GROUPs that include private members.
- Deploy Token for writes; incognito
/explore+ detail commands for verification; never hand-write/v2for Docker.
Top comments (0)