The same Cargo and npm.
Point your clients at your server. Publish and install with the commands you already know, including scoped npm packages and Cargo registry dependencies.
crateyard / package registry
Your packages.
Your server.
Crateyard keeps your Rust crates and npm packages on a server you control. One Go binary, a TOML config, and the tools you already use.
No database service. No separate frontend server.
# Start your registry
$ ./crateyard -config config.local.toml
# Publish a Rust crate
$ cargo publish --registry selfhost
# Publish an npm package
$ npm publish \
--registry http://localhost:8080/npm/One executableWeb UI included
Two ecosystemsRust crates + npm packages
Your diskMetadata and archives as files
Your choicePublic or private reads
Less to run
A registry, without
another stack to manage.
Packages live on disk.
Metadata and version archives stay in your data directory. No database to provision. Stop the server and back up that directory plus your config.
A web UI comes with it.
A dark package index with publisher names, filters, versions, tags, and copyable install commands. The entire UI is embedded in the binary.
Open reads. Or keep them private.
Choose with private = true or false. Each user has their own token. Publishing and yanking always require authentication.
Start on localhost
Build. Configure. Run.
Build with Go 1.23 or newer. After that, your server only needs the executable and its config. The commands below use a Linux or macOS shell.
-
Build the binary
git clone https://github.com/skorotkiewicz/registry.git crateyard cd crateyard go build -ldflags="-X main.version=$(cat VERSION)" -o crateyard ./cmd/crateyardSkip compilation with a release binary for Linux, macOS, or Windows, on amd64 or arm64. On Arch Linux:
yay -S crateyard-bin. -
Give yourself a token
cp config.toml config.local.toml chmod 600 config.local.toml openssl rand -hex 32Paste the generated token into your
[[users]]entry'stokenfield inconfig.local.toml. The supplied config is private by default and will not start with an empty token. -
Start your registry
./crateyard -config config.local.tomlOpen
http://localhost:8080and enter your token to browse packages. Configure Cargo or npm below, then publish your first package. On Windows, start the downloaded binary withcrateyard.exe -config config.local.toml.
Meet your existing tools
Change the endpoint.
Keep the commands.
Set REGISTRY_TOKEN in your client shell to your generated user token. Keep it out of Git.
Rust crates
CargoAdd to ~/.cargo/config.toml:
[registries.selfhost]
index = "sparse+http://localhost:8080/cargo/"
credential-provider = "cargo:token"Publish from your crate's directory:
export CARGO_REGISTRIES_SELFHOST_TOKEN="$REGISTRY_TOKEN"
cargo publish --registry selfhostnpm packages
npmAdd to your project's .npmrc:
@selfhost:registry=http://localhost:8080/npm/
//localhost:8080/npm/:_authToken=${REGISTRY_TOKEN}Use a package name such as @selfhost/my-package:
npm publish --registry http://localhost:8080/npm/
npm install @selfhost/my-package --no-auditBefore you deploy
Small on purpose.
Is this meant for a small team?
Yes. It runs as one process with disk storage and a shared request lock. It is built for individuals and small teams, not high-throughput public hosting. All configured users have the same publishing permissions, so give tokens only to people you trust.
Can anyone install my packages?
With private = false, anyone can browse and download. With private = true, readers need a configured user's token. Both modes require a token for publishing and yanking.
Do I need Node or Go on the server?
No. Go is needed only if you build from source. The compiled executable includes the web UI. Cargo and npm are needed on the machines that publish or install packages, not on the registry server.
Does it mirror public registries?
No. It hosts packages you publish yourself. There is no upstream proxy, user registration, npm audit service, or per-package ownership system. The README lists the supported behavior and limits.
Keep it yours