Deploy Verdaccio

Deploy and Host Verdaccio on Railway

Verdaccio is a lightweight Node.js private npm registry. Teams self-host Verdaccio so internal packages live somewhere they control rather than on the public npm registry, and so every npm install of a public dependency is served from a local cache instead of the internet. It speaks the ordinary npm protocol, so npm, yarn, pnpm and bun work against it with nothing but a registry URL, and anything it does not hold locally it fetches from npmjs.com once and serves from then on.

Deploy Verdaccio here and you get one service with a persistent volume, a public HTTPS URL and authentication already on. Package reads require a login, self-registration is disabled so a public URL never becomes an open registry, and the first account is created from the username and password you set at deploy time. Tarballs, the cached mirror, the user database and the signing key all live on the volume, so redeploys keep every package intact.

Getting Started with Verdaccio on Railway

Set VERDACCIO_ADMIN_USER and VERDACCIO_ADMIN_PASSWORD before deploying — those become your registry account, and there are no default credentials to change afterwards. When the deploy goes green, open the public URL: the web UI shows an empty package list and a Login button. Sign in with the pair you just set.

The registry is more useful from a terminal. Point npm at it and log in:

npm login --registry https://your-registry.up.railway.app/

Then publish something. From any package directory, npm publish against that registry uploads the tarball, and the web UI shows it with its readme, keywords and version history. To prove the proxy half works, install a public package through it — npm install lodash — and Verdaccio fetches it from npmjs.com, keeps a copy and serves it locally next time. For daily use, put registry=https://your-registry.up.railway.app/ in your project's .npmrc.

About Hosting Verdaccio

Verdaccio solves two problems that arrive together. The first is privacy: a shared UI kit, API client or config schema should not go to a public registry, and npm offers no free way to keep one private. The second is availability: a build installing hundreds of transitive dependencies is hostage to a third-party registry, where one removed or rate-limited package breaks what worked yesterday. A local registry fixes both.

Key features:

• Private publishing with per-package rules for read, publish and unpublish
• Uplink proxying and on-disk caching of npmjs.com or any npm-compatible registry
• Scoped packages, so @yourcompany/* resolves privately while everything else proxies
• A searchable web UI with readmes, dependencies, version history and uplink sources
• Pluggable auth — htpasswd built in, with LDAP, GitHub and OIDC plugins available
• npm audit support, plus filters that block versions by age or by name
• Works unchanged with npm, yarn, pnpm and bun

The Railway architecture is deliberately simple. One container runs the registry; one volume at /data holds the package tree, the user database and the signing key. There is no separate database, queue or object storage — Verdaccio's storage layer owns all of it and is built around a single writer. The template also sets the proxy trust list, so rate limiting and the access log see real client addresses.

Why Deploy Verdaccio on Railway

Railway removes the parts of running a registry that have nothing to do with npm:

• HTTPS and a public hostname provisioned automatically
• A persistent volume that survives redeploys, restarts and upgrades
• Health check and restart policy pre-configured
• Authentication and the first account set up at deploy time
• CPU and memory scaled from a dashboard as your package tree grows

Common Use Cases

• Publishing an internal component library, SDK or config packages privately
• Caching npmjs.com so CI stops re-downloading dependencies and survives upstream outages
• Giving a monorepo a real registry to test npm publish against before a public release
• Hosting patched forks of public packages under your own scope

Dependencies for Verdaccio

• Verdaccio — built from gridalpha/verdaccio-railway on top of the official verdaccio/verdaccio:6 image, on port 4873 with a volume at /data

That repository adds a start-up script which prepares the volume, renders the registry configuration and creates your account before the server starts. Everything else is stock Verdaccio.

Environment Variables Reference

Deployment Dependencies

• Node.js 24 runtime, supplied by the base image
• Source repository:
• Upstream: , docs at

Hardware Requirements for Self-Hosting Verdaccio

Verdaccio is a single Node.js process and is cheap to run. Storage is the number that grows: the cache holds every public package version your builds have installed.

Self-Hosting Verdaccio

The closest local equivalent of this template is the official image with a named volume. The following is a shell command:

docker run -d --name verdaccio \
  -p 4873:4873 \
  -v verdaccio-storage:/verdaccio/storage \
  verdaccio/verdaccio:6

Or install it from npm and run it against a config file of your own:

npm install -g verdaccio
verdaccio --config ./config.yaml --listen http://0.0.0.0:4873

Behaviour lives in config.yaml: storage sets the data directory, auth picks the authentication plugin, uplinks names upstream registries, and packages maps glob patterns to access rules. A pattern with no proxy entry is served locally only — that is how you stop a public package of the same name merging into a private one.

Is Verdaccio Free?

Verdaccio is free and open source under the MIT licence, with no paid tier, seat limits or feature gates — what this template deploys is the complete product. That is the practical difference from npm's own paid private packages and from commercial artifact repositories, where private hosting is the thing you pay for. On Railway you pay only for the container and the volume it uses.

FAQ

What is Verdaccio?

Verdaccio is an open-source private npm registry written in Node.js. It hosts your own packages and proxies public ones from npmjs.com, caching what it fetches so later installs are local.

What does this Railway template deploy?

A single Verdaccio service with a persistent volume at /data, a public HTTPS URL, a health check and authentication enabled. Your account is created at start-up from the username and password you supply, and anonymous sign-ups are blocked.

Why does the template need a volume?

The volume is the registry itself. Published tarballs, cached public packages, the user database and the token signing key all live there, so without it a redeploy would start an empty registry and invalidate existing logins.

How do I add more users to my self-hosted Verdaccio?

Self-registration is off by default so strangers cannot sign up. Set VERDACCIO_MAX_USERS to a positive number to allow npm adduser, or swap in one of Verdaccio's LDAP, GitHub or OIDC authentication plugins for a real identity provider.

How do I stop a public package overriding my private one?

Set VERDACCIO_PRIVATE_SCOPE to your organisation's scope, such as @acme. Packages under it are served only from local storage and never merged with whatever npmjs.com publishes under the same name — the standard defence against dependency confusion.

Can I use Verdaccio with yarn, pnpm or bun?

Yes. Verdaccio implements the npm registry protocol, so any client that talks to npmjs.com works once its registry setting points at your URL, on the command line or in .npmrc.

Is it safe to expose my registry on a public URL?

With this template's defaults, yes: package reads require authentication, registration is closed, tokens are signed JWTs and login endpoints are rate limited. Keep the URL among your team and leave VERDACCIO_PACKAGE_ACCESS at $authenticated for the tightest setup.