Configuring Nexus as a private registry for npm packages

setup.md

Get the details to connect to your Nexus-managed npm repository

Note: Nexus group repositories (good example in this StackOverflow question) are out of this tutorial's scope. In any case, deployment to group repositories is currently still an open issue for Nexus 3 (and not intended ever to be implemented in Nexus 2). Thus, it is assumed that we'll push & pull to/from the same repository, and ignore the idea of groups hereon in.

1. Ask your sysadmin for a username & password allowing you to log into your organistation's Nexus Repository Manager.

2. Test the login credentials on the Nexus Repository manager at: http://localhost:8081/nexus/#view-repositories (localhost in our case is replaced by a static IP, and can only be connected to over VPN). If your organisation requires a VPN to connect to it, connect to that VPN before proceeding with this tutorial.

3. Grab the repository path to your internal npm repo. In our case, it's of format 'npm' and type 'hosted'. It resembles the form: http://localhost:8081/nexus/content/repositories/npm-internal.

4. Grab the repository path to your mirror of the npm public repo. In our case, it's of format 'npm' and type 'group'. It resembles the form: http://localhost:8081/nexus/content/groups/npm-all

Publishing an npm package to your Nexus-managed npm repository

1. Ensure that your VPN connection is still alive! Otherwise when we come to publish (or npm login, a convenience introduced for Nexus 3 users), that step step will not proceed.

2. npm login is not implemented for Nexus 2, wherein you have to manualy set up your .npmrc file instead. We'll thus proceed with Nexus 2-compatible instructions: Create an .npmrc file in your npm repository as follows (proceeding as if your name is 'John Smith' and you work for 'my-org'):

init.author.name = John Smith
init.author.email = [email protected]
# an email is required to publish npm packages
email[email protected]

# A good default to start with. But if you find that you have problems
# installing npm packages from GitHub repos (which is a case in which
# this npm error may arise):
#   npm ERR! code E401
#   npm ERR! Unable to authenticate, need: Basic realm="GitHub"
# ... then you might find that removing this line may form part of the
# solution!
always-auth=true

# This is the registry to PULL from, so you likely want it to be npm-all to
# get access to all npm repos, rather than npm-internal (private repos only).
registry=http://localhost:8081/nexus/content/groups/npm-all

# base64-encoding of the username-password pair for your Nexus Repository
# Manager. In this case: admin:admin123
_auth=YWRtaW46YWRtaW4xMjM=

Note: If you have both Nexus 3 and an npm login-compatible username (eg. all-lowercase letters), instead of writing this whole file manually, you could run the command npm login --registry=http://localhost:8081/nexus/content/groups/npm-all, then providing the login details for your Nexus Repository Manager as prompted. In such case, again ensure that the VPN is still connected when running the command.

3. Add the following lines to your package.json as a top-level property to provide a publishing destination:

"publishConfig": {
    "registry": "http://localhost:8081/nexus/content/repositories/npm-internal/"
}

4. Optionally add publish-my-org and prepublish scripts to the package.json too:

"scripts": {
    "lib": "./node_modules/.bin/tsc --project tsconfig.json",
    "publish-my-org": "npm publish --registry http://localhost:8081/nexus/content/repositories/npm-internal/",
    "prepublishOnly": "npm run lib"
}

5. Before publishing, ensure that your package.json specifies all the files you want to include in the files field, and any you want to ignore, in the optional .npmignore file. Delete any build files (and package-lock.json and node_modules) carried over from another branch's previous checkout if relevant before building for publishing. Ensure the project's version number is up to date.

6. Ensure your VPN connection is still active, and run npm run publish-my-org. I accidentally ran npm publish, yet it mercifully appears to use the registry recorded in publishConfig in such case, so there's no real necessity for the npm run publish-my-org script apart from peace of mind.

Pulling an npm package from your Nexus-managed npm repository

1. Add just the following line to your parent project's .npmrc (no need for _auth field):

# For pulling
registry=http://localhost:8081/nexus/content/groups/npm-all/

2. Optionally set your parent project as private in the package.json, to prevent it ever being accidentally published to the public registry:

"private": true

3. You can refer to your npm package in dependencies (or any similar field) as you would any normal public npm package (we didn't use a scope):

"devDependencies": {
    "my-internal-proj": "1.0.0"
}

4. You should require an active connection to your VPN in order to successfully perform npm install.

References

• Sonatype/Nexus Repository Manager 3/npm latest documentation

• Sonatype/Nexus Repository Manager 2/npm legacy documentation

• Using Nexus 3 as your repository official Sonatype blogpost.

• Publishing to Nexus groups StackOverflow question (for example of how publishing command relates to registry).

• .npmrc official NPM documentation

• npm publish official NPM documentation

• Working with private modules official NPM documentation