thiagohdeplima

Self hosted hex repo

My team is building various micro-services using elixir.

Some of needs of systems is shared (for example: authentication).

To not duplicate code in each system, we create a some libraries implementing shared code between systems. This libraries contains business rules, therefore, not be open-sourced.

I would like create a private repository in our infrastructure, but, I dont find a documentation wich describe the process of it to me.

Analising the mix deps.get behavior, I see it gets packages from repo.hex.pm, which in turn is a S3 bucket, therefore, I conclude that it is not very hard.

Can someone help-me to found the documentation about it?

9 comments

#hex #deployment

0 7150 9

2023-11-09 19:48:44 UTC

First Post!

idi527

Maybe reading through GitHub - hexpm/hexpm: API server and website for Hex · GitHub or GitHub - hexpm/hex: Package manager for the Erlang ecosystem. · GitHub might help.

Post #1

Most Liked

aseigo

There is good documentation at https://hex.pm itself. You can host your own internal installation of hexpm (it’s a Phoenix app, yay! ) and then you can use the :repo option in the relevant depencies in the mix.exs file as noted in the docs here.

Post #2

zazaian

Apparently I’m still locked on this topic - @wojtekmach introduced MiniRepo roughly three months ago which looks like a good way to get a quick, private hex server up and running if cloning and deploying all of hex.pm proves to be overkill.

That said, I’ve found @ericmj and the hex.pm team to be extremely helpful and supportive. Seems like any of the above options will work well. Really just depends on personal preferences.

Post #8

josevalim

Creator of Elixir

Git works if you have one or two packages but at the moment you have multiple packages and they depend each other, Hex private is probably the best option since we can’t perform dependency resolution on top of Git.

Post #5

Last Post!

apreifsteck

Hello! For reasons that are not good, but beyond my control, I find myself trying to roll a self-hosted hexpm server. I’m currently working on adding azure blobs as a storage client. In my tests I am able to push a package to my local instance and pull it back down, but I have to set the environment variable HEX_NO_VERIFY_REPO_ORIGIN=1 . When I do not set this I get the error

13:44:54.008 [error] GenServer Hex.Registry.Server terminating
** (Mix.Error) Fetched deprecated registry record version from repo local. For security reasons this registry version is no longer supported. The repository you are using should update to fix the security reason. Set HEX_NO_VERIFY_REPO_ORIGIN=1 to disable this check.

Does anyone know how to “update to fix the security reason”? I wasn’t able to find any documentation about it except for this entry in the hex documentation, but that didn’t give me a direction on how to fix it… The only thing I’ve really changed is the storage layer. Otherwise I’m running the dev server, so maybe it’s because some of this config from runtime.exs is going unset?

    secret_key_base: System.fetch_env!("HEXPM_SECRET_KEY_BASE"),
    live_view_signing_salt: System.fetch_env!("HEXPM_LIVE_VIEW_SIGNING_SALT"),
    secret: System.fetch_env!("HEXPM_SECRET"),
    private_key: System.fetch_env!("HEXPM_SIGNING_KEY"),

Apologies for the possible naive question (and reviving a dormant thread). I’m not very security-literate so it’s been difficult to try and puzzle my way through this.

Post #10