1. Overview
Settings → Repositories → Defaults and network holds defaults for every repository and how Depotex reaches remote registries such as Maven Central, npm or Docker Hub: the upstreams that proxy repositories fetch from, and the Test connection of an upstream. Super admins only; available on every license tier. Changes reach every server within a few seconds. The Repositories group in Settings also holds Quarantine, the Block list, Integrity and, on Enterprise, Vibe artifacts.
2. Artifacts
Largest artifact (10 GB by default) applies to uploads and to files downloaded from remote registries. A file over it is stopped while it streams, and nothing of it is kept.
3. Default storage quota for new spaces
Every space created from now on starts with this storage quota: 50 GB unless you change it here. Choose No limit to create spaces without a quota, or Limit with the size in GB or TB and when to warn (80% by default). Whoever creates a space can give it another quota, or none, in the create form; changing the default never touches existing spaces, which keep their own quota (or none).
4. Remote registries
| Setting | Default | Meaning |
|---|---|---|
| Connect timeout | 10 s | How long to wait to connect, and for the TLS handshake |
| Response timeout | 60 s | How long to wait for a registry to start answering, and how long a download may send nothing before it is stopped (the client can try again). A download that keeps sending, however slowly, isn't cut off |
| Retries | 2 | How many times a failed request is tried again |
5. Outbound proxy
Turn on Reach remote registries through an HTTP proxy when servers can only reach the internet through a proxy. Enter it as http://host:port (or https://), with a username and password when it needs them; the password is stored encrypted and never shown again. Don't use the proxy for lists hosts that are reached directly, one per line: a host (nexus.corp), a domain and its subdomains (.corp.example), an IP address or range (10.0.0.0/8). Local addresses never use the proxy.
6. Test a connection
The Test a connection panel beside the settings takes a registry's URL (or one of the shortcuts: Maven Central, npm, Docker Hub); select Test. Under it, The test uses shows the route (the proxy, or direct), the timeouts, retries and how many certificates you added. Depotex sends a request with the settings on the page — saved or not — through the proxy and trusted certificates, and reports the time and HTTP status, or what failed: an untrusted, expired or mismatched certificate, the proxy unreachable or refusing the password, the host name not found, no connection, or no answer in time. Any HTTP answer, even 401 or 404, means the path works.
7. Trusted certificates
Depotex trusts the operating system's CA certificates. To reach registries whose certificates are signed by your organization's own CA, add that CA here.
- Paste PEM — Paste one certificate (-----BEGIN CERTIFICATE-----) and, optionally, a name. Private keys are refused.
- Or load from a server — Enter a host, host:port or URL and select Load. Depotex shows the certificates the server presents, numbered from the server's own, each with its issuer, expiry and SHA-256 fingerprint, without trusting them; select Trust on the CA that signed it (usually the last one).
Each certificate is marked Valid, Expires in N days (30 days or less) or Expired; select it to see its subject, issuer, expiry and SHA-256 fingerprint. Add certificate opens the paste and load-from-a-server forms. Removing one stops trusting registries it signed. Up to 100 certificates.
Load from a server connects directly, not through the outbound proxy. Check the fingerprint with the registry's owner before trusting a certificate.
8. Metadata of every repository
Super admins (or anyone with the depot write permission) can check or repair the metadata of every hosted and proxy repository at once, or of one format's, in the Metadata of every repository card: choose a format (or All formats) and select Check all or Repair all. One rebuild per repository is queued and run in the background, one at a time; repositories that already have one queued or running are skipped. The card lists the latest results, each linking to the repository, whose own Metadata card has the details. See Rebuild metadata for what a check and a repair do.
Through the API: POST /api/repair with {"mode": "check"} or {"mode": "repair"} and an optional format, and GET /api/repair for what is queued or running and the latest results.
9. Defaults for operators
| Environment variable | Default | Meaning |
|---|---|---|
| REPOSITORY_MAX_ARTIFACT_SIZE | 10737418240 (10 GB) | Largest artifact in bytes until a super admin saves settings (1 MB to 1 TB) |
| SPACE_DEFAULT_QUOTA | 50000000000 (50 GB) | Storage quota a new space gets, in bytes, until a super admin saves settings; 0 means new spaces have no limit |
| SPACE_DEFAULT_QUOTA_WARN_PERCENT | 80 | Warning threshold of that quota, 1 to 100 percent |
| REMOTE_CONNECT_TIMEOUT | 10s | Connect timeout (1s to 300s) |
| REMOTE_READ_TIMEOUT | 60s | Response timeout (1s to 3600s) |
| REMOTE_RETRIES | 2 | Retries (0 to 10) |
| PROXY_STRICT_CHECKSUMS | true | Proxy checksums (Settings → Security) until a super admin saves it: true refuses a file whose checksum doesn't match in proxy repositories set to Use the Security setting, false serves it and logs a warning |
Set them the same on every server. Once settings are saved on the page, the page's values apply. A server with an invalid value doesn't start.
10. Events
repository_settings.update, repository_settings.proxy_checksums.update, trusted_certificate.create and trusted_certificate.delete (before and after, blocking) are raised on changes. They never carry the proxy password. See Events.
11. Permissions
| Permission | Who | Allows |
|---|---|---|
| repository_settings:manage | Super admins only | Viewing and changing these settings and the trusted certificates, testing connections, and Settings → Security → Proxy checksums |
Every change and every connection test is recorded in the audit log.