# Verdaccio > A lightweight open source private Node.js proxy registry. Runs on Node.js, caches packages from upstream registries, and is extended through plugins for authentication, storage, middleware, themes and metadata filtering. ## Release lines `6.x` is the current stable line, published as `latest`, and requires Node.js 22 or newer. `7.x` is the next major, published as `next-7`, and requires Node.js 24 or newer. Versions 5 and older are end of life. Only the `verdaccio` binary is tagged after its own line: the `@verdaccio/*` packages and the plugins it is built from are tagged `latest` for 6.x and `next-9` for 7.x, and the `6-next` and `next-7` tags on those packages are stale prereleases that should not be used. ## Things commonly got wrong - The default `htpasswd` hashing algorithm is **bcrypt** with 10 rounds, on every supported version. `md5`, `sha1` and `crypt` exist only to read files written by other tools. - The plugin interfaces are `ExpressMiddleware`, `Auth`, `Storage`, `StorageHandler` and `ManifestFilter`, all under `pluginUtils` in `@verdaccio/core`. The names `IPluginMiddleware`, `IPluginAuth`, `IPluginStorage`, `IPackageStorage`, `IStorageManager` and `IPlugin` were removed, and so was the `@verdaccio/commons-api` package — its helpers are `errorUtils` in `@verdaccio/core`. - Storage plugins use a **promise** contract. The callback contract is 6.x only and runs through a compatibility adapter on 7.x. - The configuration file is resolved through `XDG_CONFIG_HOME` (`~/.config/verdaccio/config.yaml`). `XDG_DATA_HOME` only decides where the default storage goes. - The feature-flag section is `flags`; `experiments` is the former name and still accepted. `stage` and `tfa` are 7.x only. - The web UI options are `enabled` and `primaryColor`; `enable` and `primary_color` are deprecated spellings. - Log rotation is not built in, and the default log format is `json` when `NODE_ENV=production`, `pretty` otherwise. ## Documentation - [What is Verdaccio?](https://www.verdaccio.org/docs/what-is-verdaccio): What Verdaccio is, what problems a private npm proxy registry solves, and when you want one. - [Installation](https://www.verdaccio.org/docs/install): Install Verdaccio with pnpm, npm, yarn, Docker or Helm, and the Node.js version each line requires. - [Command Line Tool](https://www.verdaccio.org/docs/cli): The verdaccio command: its options, where the configuration file and the storage are resolved from, and the config file formats accepted. - [Using a private registry](https://www.verdaccio.org/docs/cli-registry): Point npm, pnpm or yarn at Verdaccio: the four steps every setup needs, and where each client keeps its configuration. - [bun](https://www.verdaccio.org/docs/setup-bun): Use Verdaccio with bun. - [npm](https://www.verdaccio.org/docs/setup-npm): Use Verdaccio with npm: registry configuration, login, publishing, tokens, and the auth and lockfile problems people hit. - [pnpm](https://www.verdaccio.org/docs/setup-pnpm): Point pnpm at Verdaccio: registry, scopes, authentication and publishing, and where pnpm differs from npm. - [yarn](https://www.verdaccio.org/docs/setup-yarn): Use Verdaccio with yarn, both classic 1.x and modern, including the plugins needed for authentication. - [Configuration File](https://www.verdaccio.org/docs/config): The config.yaml reference: storage, authentication, uplinks, package access, the token secret, server and security settings, notifications, logging... - [Uplinks](https://www.verdaccio.org/docs/uplinks): Configure upstream registries: authentication, timeouts, retries, caching and failover between several uplinks. - [Package Access](https://www.verdaccio.org/docs/packages): The packages block: grant or deny access, publish and unpublish per package pattern, and how the groups $all, $anonymous and $authenticated resolve. - [Authentication](https://www.verdaccio.org/docs/auth): How authentication works: the default htpasswd plugin and its hashing algorithms, the built-in groups, and how access is resolved with a custom plu... - [Web Configuration](https://www.verdaccio.org/docs/web): Configure the web interface: title, logo, colours, dark mode, which features are visible, and injecting your own scripts. - [Plugins](https://www.verdaccio.org/docs/plugins): The five kinds of plugin Verdaccio accepts, how to install and configure them, and where to find published ones. - [Ansible](https://www.verdaccio.org/docs/ansible): Install and configure Verdaccio with Ansible. - [Best Practices](https://www.verdaccio.org/docs/best-practices): Recommended practices for running Verdaccio: locking down access, protecting private packages, tokens, HTTPS and what to avoid in production. - [Caching strategies](https://www.verdaccio.org/docs/caching): How Verdaccio caches upstream packages on disk, and the strategies and storage plugins available for changing that. - [Changing a password](https://www.verdaccio.org/docs/change-password): Let users change their own password from the web UI, and the password policy you can enforce. - [Chef Cookbook](https://www.verdaccio.org/docs/chef): Install and configure Verdaccio with the Chef cookbook. - [Docker](https://www.verdaccio.org/docs/docker): Run Verdaccio from the official Docker image: tags, mounting configuration and storage, building your own image, and docker-compose. - [End to End testing](https://www.verdaccio.org/docs/e2e): Publish to a throwaway Verdaccio registry in CI and install your packages exactly as your users will. - [Environment Variables](https://www.verdaccio.org/docs/env): Every environment variable Verdaccio reads: the Docker ones, the public URL and proxy headers, storage paths and the legacy token key. - [GitHub Actions](https://www.verdaccio.org/docs/github-actions): Publish and test packages against Verdaccio from a GitHub Actions workflow. - [Installing on IIS server](https://www.verdaccio.org/docs/iis-server): Run Verdaccio behind IIS on Windows Server. Community-maintained and written for a much older stack. - [Kubernetes](https://www.verdaccio.org/docs/kubernetes): Deploy Verdaccio on Kubernetes with the official Helm chart, including persistent storage and the configuration configMap. - [Linking a Remote Registry](https://www.verdaccio.org/docs/linking): Link Verdaccio to another registry so it proxies and caches packages it does not host itself. - [Logger](https://www.verdaccio.org/docs/logger): Configure Verdaccio logging: output type, level, pretty or JSON format, redaction of sensitive fields, and log rotation. - [Logotype](https://www.verdaccio.org/docs/logo): Download the Verdaccio logo: symbol, banner and black and white, in SVG and PNG. - [Notifications](https://www.verdaccio.org/docs/notifications): Send a webhook when a package is published, with templated payloads for Slack, Teams and anything else that accepts JSON. - [Protecting packages](https://www.verdaccio.org/docs/protect-your-dependencies): Stop private packages from being published or read by the wrong people, and avoid dependency confusion with upstream registries. - [Puppet](https://www.verdaccio.org/docs/puppet): Install and configure Verdaccio with Puppet, on Debian, Ubuntu, Fedora and RedHat. - [Reverse Proxy Setup](https://www.verdaccio.org/docs/reverse-proxy): Put Verdaccio behind nginx, Apache or another reverse proxy, including the headers and the trustProxy setting it needs. - [Server Configuration](https://www.verdaccio.org/docs/server): Run Verdaccio permanently on a Linux server: a dedicated user, a process manager, and binding to a privileged port. - [Set up the SSL Certificates](https://www.verdaccio.org/docs/ssl): Serve the registry over HTTPS, either with Verdaccio own certificates or from behind a proxy. - [Staged publishing](https://www.verdaccio.org/docs/staged-publishing): Put a review step in front of every publish with npm stage, so a version only becomes installable once a maintainer approves it. - [Two-factor authentication](https://www.verdaccio.org/docs/two-factor-authentication): Protect accounts with a time-based one-time password, using the standard npm profile commands. - [Usage & Adoption](https://www.verdaccio.org/docs/usage-adoption): Verdaccio usage and version adoption across npm and Docker. - [User registration](https://www.verdaccio.org/docs/user-registration): Let people create their own account from the web UI instead of an administrator editing the credentials file. - [Browser-based login](https://www.verdaccio.org/docs/web-login): Let npm login authenticate through the browser instead of prompting for a username and password in the terminal. - [Who is using Verdaccio?](https://www.verdaccio.org/docs/who-is-using): Companies and open source projects using Verdaccio in production. - [Installing As a Windows Service](https://www.verdaccio.org/docs/windows): Run Verdaccio as a Windows service so it starts with the machine. ## Developing plugins - [Developing Plugins](https://www.verdaccio.org/dev/dev-plugins): When a Verdaccio plugin is the right answer, the five kinds you can write, and what each one costs you. - [Node API](https://www.verdaccio.org/dev/node-api): Start Verdaccio programmatically with runServer, and build its configuration with ConfigBuilder. - [Authentication Plugin](https://www.verdaccio.org/dev/plugin-auth): Write an authentication plugin: the callback contract, what each answer means, and how a chain of plugins resolves a request. - [Filter Plugin](https://www.verdaccio.org/dev/plugin-filter): Write a filter plugin to rewrite package manifests, and the performance caveats of running on the search path. - [Plugin Generator](https://www.verdaccio.org/dev/plugin-generator): Scaffold a Verdaccio plugin with the Yeoman generator. - [Middleware Plugin](https://www.verdaccio.org/dev/plugin-middleware): Write a middleware plugin: where it runs in the request chain, what is already parsed, and the Express 5 route syntax. - [Storage Plugin](https://www.verdaccio.org/dev/plugin-storage): Write a storage plugin: the promise contract, the legacy callback one, and the tarball lifecycle that decides whether a publish succeeds. - [Theme Plugin](https://www.verdaccio.org/dev/plugin-theme): Write a theme plugin: how Verdaccio loads it, what it must export, the asset manifest contract and the web endpoints a theme can call. - [Verifying a plugin](https://www.verdaccio.org/dev/plugin-verifier): Check that Verdaccio can load your plugin, from the CLI or from a test, without starting a registry. - [Search for Plugins & Tools](https://www.verdaccio.org/dev/plugins-search): Search the plugins and tools published by the Verdaccio community. - [UI Components](https://www.verdaccio.org/dev/ui-components): Reuse the React components the default Verdaccio theme is built from.