verdaccio-minio (v6 fork)

Verdaccio 6.x storage plugin backed by MinIO / S3-compatible object storage.

Forked from barolab/verdaccio-minio 0.2.5 (which targeted the Verdaccio 4.x plugin API and has been unmaintained since 2020-03), ported to the Verdaccio 6 plugin API:

• No @verdaccio/* runtime dependencies — the plugin duck-types the storage interface, so it cannot break on @verdaccio/core / @verdaccio/streams upgrades.
• Single runtime dependency: minio (v8).
• Constructor defensively accepts both (config, { logger }) (v4 style) and (config, logger) (v6 style) call signatures.
• Object layout in the bucket is unchanged from the original plugin (db.json, tokens.json, <pkg>/package.json, <pkg>/<tarball>), so data written by the old plugin remains readable.

Install

npm install --global @yimeng.ch/verdaccio-minio
# or in a custom Docker image:
# RUN npm install --global --omit=dev @yimeng.ch/verdaccio-minio

Configuration

The plugin is scoped, so the store key is the full package name (Verdaccio resolves scoped plugin names as-is):

store:
  '@yimeng.ch/verdaccio-minio':
    endPoint: minio.internal      # MinIO host (no protocol)
    port: 9000                    # default: 443 if useSSL else 80
    useSSL: false
    accessKey: ${MINIO_ACCESS_KEY}
    secretKey: ${MINIO_SECRET_KEY}
    bucket: verdaccio             # default: "verdaccio"; auto-created on startup
    region: us-east-1             # default: "us-east-1" (MinIO ignores it)
    # prefix: verdaccio/          # optional: store all objects under
                                  # "<bucket>/<prefix>/" so verdaccio can share
                                  # a bucket with other data (slashes are
                                  # normalized; omit for root-level storage)
    # retry:                      # optional, wraps all storage operations
    #   delay: 500                #   ms between retries (default 500)
    #   retries: 10               #   attempts (default 10, -1 = forever)

Credentials via environment (recommended): verdaccio does not expand ${VAR} placeholders inside the store section, so this plugin resolves accessKey / secretKey itself — a missing value or a literal "${...}" placeholder falls back to MINIO_ACCESS_KEY / MINIO_SECRET_KEY from the environment. Credentials never need to live in the config file.

The bucket is created automatically on startup if the credentials have permission; otherwise create it beforehand.

Note: the prebuilt Docker image installs the plugin under its scoped name and additionally links it as verdaccio-minio, so both store: '@yimeng.ch/verdaccio-minio': and store: minio: work there. If you install the plugin yourself from source or a tarball under the unscoped name verdaccio-minio, the store key is simply minio:.

Notes

• Sharing a bucket: set prefix (e.g. verdaccio/) and every object is written under <bucket>/<prefix>/, leaving other data in the bucket untouched. With a prefix configured you can also drop the s3:CreateBucket permission — initialize() only creates the bucket when it is missing, so credentials only need ListBucket + object read/write/delete on the prefix.
• Token storage (saveToken/readTokens/deleteToken) is kept in tokens.json in the same bucket, matching the Verdaccio 6 storage-plugin contract.
• search stats, secrets (getSecret/setSecret) and the package list all live in the bucket, so multiple Verdaccio replicas can share one bucket — but concurrent writes to db.json are last-write-wins (same semantics as the original plugin; do not run write-heavy replicas concurrently).