AngusRepo is an artifact repository: 28 common formats, and clients only change the address to pull and publish. Your own packages go into a Hosted repository. A public upstream goes into a proxy, and the first pull is cached here. Hosted and proxy repositories of the same format can sit in a group, so a client pulls from one address. mvn, npm, docker, and the other clients in the table keep their commands. Artifacts stay on the disk of this install, and they can stay on your network.
The main problems it solves
- Maven, images, Python, and npm each need their own registry, and keeping that set together means a separate install, upgrade, and permission setup for each one. Nexus, Harbor, pypiserver, and Verdaccio each keep their own install and their own accounts. Those formats go into one artifact repository.
mvn,docker,pip, andnpmkeep their commands. You change the address. - A build machine waits on every dependency, and the next machine downloads them again. A public package needs one cache here, and later machines use the same address.
- Internal packages move as files, and each project config lists a long row of repository addresses. Pull and publish should change only the address.
- A package is already known to be bad, and the pipeline can still pull it. Ingest has to be able to stop that known problem.
Note: It does not replace those clients, and it does not scan source code. What a repository can show is whether an artifact already inside it has a known vulnerability or a license problem. Code security, secrets, and a release gate across repositories are done in the security product. The connection is under System → Security integration. A group stores no files. Publish still points at Hosted. Do not use the group address as the publish address.
What it includes
The first screen after sign-in is Overview. Storage use, uploads and downloads, and the security-risk picture are read on this screen.
Three repository types. When the create page opens Repository type, the three names are Hosted, Proxy, and Group. After you select one, the box shows Hosted, Proxy, or Group, and the repository list filters with those English words.
Hosted stores packages you publish. A proxy caches the upstream you type, such as Maven Central, Docker Hub, or the public npm registry. A group answers pulls in member order and stores no files of its own. Move members up or down on the Members tab of the detail page. The repository name cannot be changed after creation.
When a client both downloads and publishes, the download address is the group or the proxy, and the publish address is Hosted. The two repositories must use the same format, and that Hosted repository must be a member of the group. Opening Setup on only one of them shows only that repository's address. A proxy or a group does not show publish steps on Setup.
28 formats. Pick the format first. The type dropdown lists all three. A cross in the table means save is rejected, or the format does not offer that type. The host and repository name in a path come from the string you copy on Setup.
| Format | Client | Hosted | Proxy | Group |
|---|---|---|---|---|
| Maven | mvn, Gradle | Yes | Yes | Yes |
| Docker | docker | Yes | Yes | Yes |
| npm | npm, Yarn, pnpm | Yes | Yes | Yes |
| PyPI | pip, twine | Yes | Yes | Yes |
| NuGet | dotnet, nuget | Yes | Yes | Yes |
| Helm | helm | Yes | Yes | Yes |
| Go | go | Yes | Yes | Yes |
| APT | apt-get | Yes | Yes | Yes |
| YUM | yum, dnf | Yes | Yes | Yes |
| Raw | curl | Yes | Yes | Yes |
| Alpine | apk | Yes | Yes | Yes |
| Ansible | ansible-galaxy | Yes | Yes | Yes |
| Arch | pacman | Yes | Yes | Yes |
| Cargo | cargo | Yes | Yes | Yes |
| Chef | knife, Berkshelf | Yes | Yes | Yes |
| CocoaPods | pod | No | Yes | No |
| Composer | composer | Yes | Yes | Yes |
| Conan | conan | Yes | Yes | See below |
| Conda | conda | Yes | Yes | Yes |
| CRAN | R | Yes | Yes | Yes |
| Hugging Face | huggingface-cli | No | Yes | No |
| OCI | oras, helm | Yes | Yes | Yes |
| p2 | Eclipse, Tycho | No | Yes | No |
| Pub | dart, flutter | Yes | Yes | Yes |
| RubyGems | gem, Bundler | Yes | Yes | Yes |
| Swift | swift, Xcode | Yes | Yes | Yes |
| Terraform | terraform | Yes | Yes | Yes |
| Vagrant | vagrant | Yes | Yes | Yes |
CocoaPods is proxy only. It does not accept pod repo push, and it cannot be a group. Hugging Face and p2 must be created as a proxy. They have no publish steps. Conan 2 is the default at creation, and all three types are allowed. Conan 1 is a separate repository, cannot be changed after creation, and cannot be a group. CRAN Hosted and group accept only the source package {Package}_{Version}.tar.gz. Binary packages are fetched from the proxy. Go pulls with GOPROXY. Putting a module into Hosted uses the upload API. Cargo uses the sparse index only. Composer is Composer 2 only. Arch is not signed in this release.
Docker and OCI paths look like /v2/<repository>/. docker pull and oras pull use <HOST>/<repository>/name:tag. /v2/ appears only in the Registry API. Putting it in the image name means the repository is not found. An OCI group's members may be OCI or an existing Docker repository. A Docker member returns an existing manifest. It does not convert the format. PyPI installs through simple/ and publishes through legacy/. Ansible's path adds /api/v3/.
The password, token, or password field in a config or command is an access token from My → Access tokens. The username is still the login name. The login password returns 401 invalid_token. A pipeline that touches only one repository can use that repository's deploy token. A deploy token starts with repod_. It cannot connect MCP.
Upload and artifacts. Upload in the sidebar puts a file into a Hosted repository that already exists. Artifacts lists files already in a repository. The web upload is for a one-off file. Day-to-day publish stays on the client commands above.
Stopping a package that must not be downloaded. Security shows whether an artifact already in the repository has a known vulnerability or a license problem. One finding can be marked fixed, suppressed, or risk accepted. A scan policy decides when to check and what to check. With "Refuse download when it does not pass" on, an artifact that reaches the threshold cannot be downloaded. With it off, the threshold only marks the artifact. It does not block. When a download is refused, handle that row under Vulnerabilities, or change the threshold on that repository's policy. A newly uploaded package can be checked by the policy automatically.
Cleanup. A policy finds old artifacts by time, count, size, or name. By time, fill in how long to keep them. By count, fill in how many newest versions to keep. By size, fill in the maximum capacity. By pattern, fill in a name regular expression, such as .*-SNAPSHOT$. The schedule can be manual, daily, weekly, or monthly.
The play control shows a preview first: items to delete, how many candidates were scanned, the space expected back, and the artifacts that would be removed. No match shows that there is nothing to delete. The preview is a reading of that moment. The real delete uses the repository at the moment you click Run cleanup. The confirm box says the selected artifacts will be deleted permanently and cannot be recovered. Deleted files cannot be brought back from the console. The repository itself remains.
Dry run counts the expected result and does not delete files. A dry run also requires the policy to be enabled. There can be at most 100 policies. A repository joins cleanup only when Enable cleanup is on in its configuration. If the dropdown says automatic cleanup is off, open that repository's Configuration → Advanced and turn it on. Deleting a policy deletes the rule. It does not delete artifacts already in the repository.
The other pages. Analytics is the usage trend. Trends are the popular artifacts and repositories. Messages are the inbox. Activities are the operation log. Members covers invitations and repository access. System includes storage, monitoring, webhooks, and, on this environment, MCP and security integration. A public repository can be opened at /explore without signing in. Explore in the header is that read-only portal.
Where it is used
The second pipeline still goes out to the public network for a dependency the first one just downloaded. Create a Maven proxy and set the upstream to the public source you use now. Open Setup on that repository and put the address into
settings.xmlor the Gradle mirror on both the developer machine and the pipeline. The password field is an access token. What the first machine pulled stays in the proxy. The next machine uses the same address. Publishing your own artifacts uses a separate Maven Hosted repository.mvn deploypoints there, not at the proxy.Every build file carries its own list of repository addresses, and the internal package and the public package are not in the same order. Create one Maven Hosted repository and one Maven proxy, then put both in one Maven group. Pull configuration writes only the group address. Publish configuration writes only the Hosted address, and that Hosted repository is already a member. To prefer the internal package, move it above the proxy under Members. npm and Docker each get their own group. Formats are not mixed in one group. Setup on the group alone does not show a publish step. That follows from the type.
A component already marked as a problem can still be pulled by the next build. Turn on "Refuse download when it does not pass" in that repository's scan policy, and set the threshold at the level you want to stop. An artifact that reaches the threshold is refused when the client downloads it. Under Vulnerabilities, mark the row fixed, suppressed, or risk accepted, or change the threshold to match the policy, then retry the client. An artifact that has not been scanned yet is not a pass.
Snapshots and layer cache fill the disk, and deleting outright may remove a version still in use. Create a cleanup policy by name or by time, for example a pattern that matches only
.*-SNAPSHOT$. Press play and read the preview first: items to delete, how many candidates were scanned, and the space expected back. With Dry run on, it only counts. It does not delete. The confirm box says the delete is permanent and cannot be undone from the console. Do not run it when the policy is disabled, or when the repository says automatic cleanup is off. Deleting the policy itself does not delete artifacts in the repository.A pipeline pushes packages with a person's login password, so the person and the machine are the same credential. On Setup, the username is the login name and the password field is an access token from My → Access tokens. The login password returns
401 invalid_token. A pipeline that touches only one repository can use that repository's deploy token. The prefix isrepod_. That token cannot connect MCP.
What is sharp about it
The command stays. The address changes. The step you skip is learning a new publish tool for a private registry.
mvn,npm,docker,pip, andhelmstay the commands they were. The developer machine and the pipeline open Setup on the same repository and copy that address. The username is the login name. The password field is an access token. The login password returns401 invalid_token.The first screen is Overview, not a menu tree. With the sidebar collapsed, an icon rail remains. The title is Overview. The blocks you can read are Storage Usage, Upload / Download Trend, Recent Activity, and Vulnerability Statistics. Storage is split by format. Maven, Docker, NPM, PyPI, and Raw are on the screen. The header has Explore, English, and the theme control. Capacity and counts change. They are not the feature list.
One group keeps one pull address. The group answers pulls in member order and stores no files. A project config does not have to list Hosted and every upstream. Publish still points at Hosted. Setup on the group alone does not show publish steps. That follows the type. The page did not omit them.
A preview comes before a delete. The play control on a cleanup policy shows the list and the space expected back. Dry run only counts. The confirm box says the delete is permanent and cannot be undone from the console. A disabled policy cannot run. If the repository has not enabled cleanup, the dropdown says automatic cleanup is off.
A package past the threshold does not download. With "Refuse download when it does not pass" on, an artifact whose check reaches the threshold is refused. With it off, the result is only a mark. The disposition happens under Vulnerabilities. You do not match package names on a second spreadsheet.
Three formats cannot be created as Hosted. CocoaPods, Hugging Face, and p2 are proxy only. Choosing Hosted or Group is rejected on save. CocoaPods also does not accept
pod repo push. Among the other twenty-five, Conan 1 alone cannot join a group. Checking the type at creation is earlier than discovering the address does not exist after the client is installed.
How you install it
This package installs AngusRepo and the sign-in portal. Open the portal first, then this product. With Docker, the wizard defaults to Docker Compose. Without Docker, use the host ZIP. If the machine cannot reach the public network, use the offline install. The Kubernetes Helm chart is a preview. Do not treat it as a production install.
Production is Linux x86_64. macOS is fine for a trial. docker compose version must print a version. On macOS, run the wizard as the user you are logged in as. Do not prefix it with sudo. To use /opt/angus on Linux, give the directory to the current user first.
Port 80 must be free. Port 443 must be free if you will use HTTPS. 8804 and 8801 belong to the applications. The proxy forwards them. Do not publish them as the browser entry. gm.<your-domain> and repo.<your-domain> must resolve to this machine. The machine must reach https://repo.anguskit.com to download the package. The unpacked directory is AngusRepo-1.0.0.
unzip <package>.zip cd AngusRepo-1.0.0 ./install.sh On Windows, with Docker Desktop, run .\install.bat. The wizard prompts are in English.
| Prompt | What you enter | What it decides |
|---|---|---|
Install mode | Press Enter | Docker Compose. If Docker is missing, use the host ZIP |
Access | Type 2 | The bundled reverse proxy and subdomains. Enter stays on access by port |
| Reverse proxy | Press Enter | Caddy. Let's Encrypt can be configured only with Caddy |
| Certificate | Type a number. There is no default | 1 is your PEM, 2 is a self-signed certificate from the package, 3 is Let's Encrypt, 4 is HTTP only |
| Database | Press Enter | Compose starts MySQL 8 on this machine |
| Install directory | Press Enter | The unpacked directory, which becomes $ANGUS_HOME |
| Apex domain | An apex such as example.com | repo.example.com adds an extra label. An IP address or localhost stops the wizard |
The administrator password must be at least 8 characters. Do not keep the public default database password the wizard offers. The data directory takes that password only the first time it is created. Changing the env files later, without changing the password already stored in the database, makes the applications fail to connect. The default string is not printed here.
Certificates 1, 2, or 3 open https://gm.<your-domain>/, then https://repo.<your-domain>/. Certificate 4 opens both with http://. A self-signed certificate makes the browser warn. On the current package, Let's Encrypt still requests certificates for all seven product hostnames, even when this machine only has this product and the portal. Those seven names must resolve here, or use a wildcard certificate. HTTP only, certificate 4, does not request them.
Success is two lines at the end of the log: doctor: OK and Install finished. The log is $ANGUS_HOME/logs/install.log. Check again with ./bin/angusctl.sh doctor. The address a client should use is the string copied from Setup. Do not guess it from an internal port in the wizard.
MCP
The entry is System → MCP. Through the gateway the address is https://<gateway-host>/repo/mcp. On a private install with no product prefix, use https://<repo-host>/mcp. The application port is 1809. Behind the reverse proxy, do not publish that port.
The token is a portal user access token whose client is xcan_tp. Put it in ANGUS_REPO_TOKEN. Do not commit it. A deploy token starting with repod_, a token from another product, or an OAuth refresh token returns HTTP 401, and the response has no tool list.
The header is Authorization: Bearer, using that variable. A stdio-only host runs the npx package @anguskit/mcp with --product repo. That process reads ANGUS_TOKEN and ANGUS_BASE_URL. Those names are not ANGUS_REPO_TOKEN from the HTTP config. ANGUS_BASE_URL is the gateway root, without /repo/mcp.
Repo MCP is read-only. There is no promote, publish, delete, run-cleanup, or issue-token tool, and it does not call /maven, /npm, or /v2. An assistant can look up coordinates, dependencies, vulnerability counts, and a cleanup preview. Pulling a package or pushing an image stays on the language client. If ANGUS_MCP_ENABLED is unset, the endpoint is on. Turn it off and the process has no /mcp. The console and the protocol paths are unchanged. The write switch is fixed off. Do not assume a tool exists that runs cleanup.
A system administrator, or an account with every read permission, should see exactly eight tools whose names start with repo_. With only artifact view, the usual four are find, locate, dependencies, and artifact security. Repository, score, and cleanup preview are absent. Point at a Maven coordinate that already exists and call repo_locate_version. The returned id is a decimal string. Several main files produce ambiguous and the candidates, not a silent pick. One account may make 30 valid tools/call requests a minute.
SDK
The official REST SDK is version 1.0.0. The Java artifact is angus-repo-sdk, package cloud.xcan.angus.sdk.repo. npm is @anguskit/angus-repo-sdk. PyPI is angus-repo-sdk. The Go module is github.com/anguskit/angus-sdk-repo. There is no official NuGet package. That NuGet package would be an SDK for the API. It is not the NuGet artifact format in the table above.
The header is Authorization: Bearer <access_token>. The gateway base URL is https://bj-c1-prod-apis.anguskit.com/repo. The prefix is /api/v1/**. The smoke call is GET /api/v1/repositories/stats. Listing repositories is GET /api/v1/repositories. Fields follow the OpenAPI document in the API reference. /innerapi is not in the official SDK.
Publish and pull do not use this SDK. Maven, npm, Docker, pip, and the others stay on their protocol paths. The SDK is the REST API for repositories and artifacts.
FAQ
Do I replace the pull command?
No. The command stays. The address becomes the string on that repository's Setup page. The password field is an access token, not the login password.
Can I publish to the group address?
No. A group only answers pulls and stores no files. Publish points at a Hosted repository of the same format, and that Hosted repository has to be a member of the group.
Why can't CocoaPods, Hugging Face, or p2 be Hosted?
Those three are proxy only. Choosing Hosted or Group is rejected on save. They also have no publish steps.
Does cleanup delete as soon as I press play?
No. Play shows the preview list first. Dry run only counts. After Run cleanup, deleted files cannot be restored from the console.
Can MCP run docker push for me?
No. MCP reads metadata. It does not call /v2 or the other protocol paths. Push and pull stay on the original client. A deploy token starting with repod_ does not connect MCP.
Where do I sign in?
Open gm.<your-domain>, then repo.<your-domain>. Read-only browsing of public repositories is Explore in the header, at /explore.
