OCI Package Proxy

Serving native package-manager protocols backed by an OCI registry.

Authenticate with an OIDC ID token in the HTTP Basic password under the username oauth2, shown below as $JWT. Mint one with lego devid token --audience oci-package-proxy on a laptop or oci-package-proxy token in CI; a local no-auth deployment needs none. See oci-native-credentials.md.

Terraform Registry

Entry point: https://dev.pkg.thelegogroup.com/.well-known/terraform.json

# Provider/module registry host (terraform routes need no credential):
terraform {
  required_providers {
    example = {
      source  = "dev.pkg.thelegogroup.com/<namespace>/<name>"
      version = "0.1.0"
    }
  }
}

Allowlisted packages:

Python (PyPI / PEP 503)

Entry point: https://dev.pkg.thelegogroup.com/simple/

pip install --index-url https://oauth2:$JWT@dev.pkg.thelegogroup.com/simple/ <package>
TWINE_USERNAME=oauth2 TWINE_PASSWORD="$JWT" twine upload --repository-url https://dev.pkg.thelegogroup.com/upload/ dist/*.whl

Allowlisted packages:

NuGet v3

Entry point: https://dev.pkg.thelegogroup.com/nuget/v3/index.json

dotnet nuget add source https://dev.pkg.thelegogroup.com/nuget/v3/index.json --name oci-package-proxy --username oauth2 --password "$JWT" --store-password-in-clear-text

Allowlisted packages:

OCI-native (Helm, container images, OCI artifacts)

Entry point: https://dev.pkg.thelegogroup.com/v2/

helm registry login dev.pkg.thelegogroup.com --username oauth2 --password-stdin <<<"$JWT"
oras login dev.pkg.thelegogroup.com --username oauth2 --password-stdin <<<"$JWT"
helm push <package>-0.1.0.tgz oci://dev.pkg.thelegogroup.com
helm pull oci://dev.pkg.thelegogroup.com/<package> --version 0.1.0
oras push dev.pkg.thelegogroup.com/<package>:<tag> <file>

Allowlisted packages: