Coming soon. Depotex is in active development, so features and these docs may still change.
Coming soonIn active development

Every package your teams build and use, on a server you run.

Depotex is a self-hosted artifact repository for 18 package formats. It caches the public registries your builds depend on and gives security teams SBOMs, quarantine and policies around every version. Run it on one server or a cluster, with the same features either way.

User guide Admin guide Container images · Helm chart · setup wizard
The Depotex dashboard: what needs attention, the installation's figures, spaces by size and the health of every part of the system
The dashboard: what needs attention, spaces by size and the health of every part of the system.
18 formats

Works with the tools developers already use.

Point your package manager at Depotex and keep your existing commands. Each space has one address per format: /repository/<space>/<format>/

All supported formats →
Mavenmvn · gradlenpmnpm · pnpm · yarnPyPIpip · uv · twineDocker & OCIdockerHelmhelmGogoNuGetdotnetCargocargo
APTaptYUMdnfTerraformterraform initHugging Facehuggingface_hubGit LFSgit lfsComposercomposerRubyGemsgemCondaconda · pixiConanconanRawcurl
For developers and CI

Host, cache and group behind one URL.

Hosted repositories hold what you publish. Proxy repositories fetch from Maven Central, npm, PyPI, Docker Hub or another Depotex and keep a copy, so builds keep working when the internet doesn't. Group repositories put both behind a single address.

Repositories→Upstreams→Repository groups→
The repositories list
Searching across repositories in the artifact browser
For everyone

Find any version and see what's inside it.

The artifact browser searches every repository you can see. Open a version for its install command, files, dependencies and security status. Depotex reads the SPDX and CycloneDX SBOMs stored with artifacts, finds a component everywhere it's used and checks it against known vulnerabilities from OSV.

Browse→SBOMs→
For security teams

Keep bad versions out, even through proxies.

Quarantine holds new or suspect versions until someone releases them. The block list refuses a version everywhere, including through proxies. Integrity checks confirm every stored file is present and unchanged, and hostile metadata is quarantined on arrival.

Quarantine→Block list→Integrity→
Quarantined versions awaiting release
Editing a policy
For platform teams

Enforce rules and react to events.

Every major operation is an event. Policies can block, warn about or adjust it before it happens, with a dry run first. Automation sends alerts, webhooks and emails after. Signed plugins add checks, screens and tools for AI agents.

Policies→Automation→Plugins→
How it's organised

Spaces hold repositories. Repositories hold versions.

01SpacePrivate, internal or public. Viewer, Developer, Maintainer and Owner roles, upload rules, cleanup and quotas.
02RepositoryOne format and one type: hosted, proxy or group.
03VersionA component's release, with its files, dependencies, SBOMs and security status.
Address/repository/<space>/<repository>/…What package managers and CI use. People use the same Depotex in the browser.

Permissions come from a person's system role and their role in each space. Tokens and applications never do more than the person behind them.

For admins

Runs where you do, and looks after itself.

Backups with encryption and test restores, a system check with per-server cluster health, scheduled jobs, an audit log and Prometheus metrics. Recovery mode explains what's wrong when an installed server can't start.

Admin guide →Install with Helm →Single node & cluster →Backups →Recovery mode →
Deploy
Container images, Helm chart
Topology
One server or a cluster
Database
PostgreSQL
Cache
Redis, optional on one server, required for a cluster
Files
Local disk, S3, MinIO or Azure Blob
Directories
Local, LDAP, Active Directory, Entra ID, Google Workspace, SCIM
Sign-in
OpenID Connect, SAML, device sign-in, workload identity
Setup
Setup wizard or an unattended setup file
Editions

Start with Standard. Add what you need.

Licensing →
StandardHosted and group repositories in every format, spaces, the artifact browser, users and groups, backups and email.
ProStandard, plusProxy repositories, clustering, the system check, the audit log, policies, automation and plugins.
EnterprisePro, plusSingle sign-on, quarantine, the block list, branding and managing everyone's API tokens.

Each feature's page says which tier it needs.

Documentation

Everything in the docs, by topic.

Start here09
Getting startedSign in, find a repository and publish your first package.Admin guideInstall, set up, configure and run Depotex.Install DepotexThe server, the setup key and the reverse proxy.Install with HelmThe chart, its values and first-boot setup.Docker & KubernetesContainer images and the Helm chart.Single Node & ClusterOne node or many, with the same features.Recovery ModeWhen an installed server can't start, and how to fix it.DashboardWhat needs a look, figures and system health.ChangelogWhat each release includes, newest first.
Repositories08
SpacesWho can use repositories, visibility and allowed formats.RepositoriesCreate and manage artifact repositories.Repository groupsSeveral repositories of one format behind one URL.UpstreamsExternal registries spaces may proxy.BrowseSearch, walk trees and open any version.Repository settingsSize limits, remote timeouts, proxies and CA certificates.StorageWhere files live, credentials and upload limits.Supported formatsEvery format and the tools that work with it.
Security07
SBOMsWhat your software is made of, and known vulnerabilities.QuarantineHold new or suspect versions until released.Block listStop a version from being used anywhere.IntegrityCheck every stored file is present and unchanged.PoliciesRules that block, warn or adjust actions.Rate Limits & QuotasRequest and download limits per person, token and address.Security advisoriesSecurity fixes, with an RSS feed to subscribe to.
Identity & access05
Users & DirectoriesWhere accounts come from and how people sign in.Single Sign-OnEntra ID, Google, Okta, Keycloak, any OIDC or SAML provider.OAuth ApplicationsPipelines, CLIs and AI agents without personal tokens.API TokensScoped tokens for automation and integrations.LicensingTiers, getting a license and updating it.
Operations07
BackupsEncrypted, checked and test-restored backups.System CheckHealth of every dependency and server, with alerts.Logging & AuditLog levels, log files and who changed what.Monitoring (Prometheus)Each server's metrics for Prometheus.Scheduled JobsThe background jobs Depotex runs.EmailSMTP, SES, Microsoft 365, SendGrid and more.Branding & BannersApp name, colors, logos and announcements.
Events & automation05
EventsWhat Depotex raises for policies, automation and plugins.AutomationAlerts, webhooks and emails when something happens.PluginsSigned plugins, including MCP tools for AI.AlertsThe bell, toasts and your preferences.Managing AlertsSend alerts, force categories, the alerts API.
Help03
Known issuesLimits and gaps to know about, with workarounds.FAQAnswers to common questions.SupportHow to get help and what to send.
Coming soon

Install, enter the setup key, and follow the wizard.

Then create a space and its first repository, and point your package manager at it.

Install Depotex →User guideChangelog