# Registries and networks

> Configure mirrors, credentials, proxies, and company certificates.

Start with:

```sh
jup info
```

The report is offline. It shows the effective registry and TLS source, and says
whether credentials are present without showing them.

## Select a registry

Set one npm-compatible registry for all built-in tools:

```sh
JUP_NPM_REGISTRY=https://npm.example.com jup cache install
```

Or set a registry/mirror for one tool:

```sh
JUP_REGISTRY_PNPM=https://mirror.example.com jup pnpm --version
```

The suffix is the upper-case tool name, with punctuation changed to `_`.

jup chooses a source in this order:

1. `JUP_REGISTRY_<TOOL>`;
2. `JUP_NPM_REGISTRY`;
3. an applicable `.npmrc` registry;
4. jup's built-in source.

A mirror must provide the package paths and npm metadata expected by the original
source. jup checks artifact URLs and refuses a tarball hosted somewhere other
than the configured registry.

## Use `.npmrc`

jup reads a limited set of npm settings from:

1. global `.npmrc`;
2. user `.npmrc`;
3. project `.npmrc`, with closer files winning.

It understands registry entries, scoped registries, scoped authentication,
certificate settings, and `strict-ssl`. It does not run commands or support the
whole npm configuration language.

A project `.npmrc` may select registries. It may not supply credentials,
certificate authorities, certificate files, or disabled TLS. Put those in a user
or global file, or in the CI environment.

Example user `.npmrc`:

```ini
registry=https://npm.example.com/
//npm.example.com/team/:_authToken=${NPM_TOKEN}
```

jup chooses the longest matching host/path credential scope.

## Authenticate

Prefer a masked CI secret:

```sh
JUP_NPM_TOKEN="$TOKEN" jup cache install
```

For Basic auth, set both:

```sh
JUP_NPM_USERNAME=alice JUP_NPM_PASSWORD="$PASSWORD" jup cache install
```

Credentials apply only to the configured registry origin. jup removes
Authorization when a redirect crosses to another origin. URL user information,
when present, is redacted from messages.

Use HTTPS for every authenticated registry. Never commit secrets in `.jup.env`,
project `.npmrc`, or command URLs. jup ignores credentials from project-owned
configuration, but other software may not.

## Configure a proxy

jup reads lower-case and upper-case forms of:

- `HTTP_PROXY`
- `HTTPS_PROXY`
- `ALL_PROXY`
- `NO_PROXY`

Lower-case values win when both are set. HTTP uses an absolute request URL;
HTTPS uses `CONNECT`.

```sh
HTTPS_PROXY=http://proxy.example.com:8080 \
NO_PROXY=localhost,.internal.example \
jup cache install
```

`NO_PROXY=*` bypasses all proxies. Entries may name a host or host suffix and may
include a port.

## Trust a company CA

Add a PEM certificate bundle:

```sh
JUP_CAFILE=/etc/company/roots.pem jup cache install
```

The bundle is added to normal system trust. It must contain PEM certificates and
must cover every registry, mirror, redirect, proxy, and key endpoint used by the
request.

The same policy can come from a user/global `.npmrc` with `cafile`, inline `ca`,
or `strict-ssl`.

For diagnosis only:

```sh
JUP_STRICT_SSL=0 jup cache install
```

This disables certificate checks and prints a warning when a request is made.
Fix the CA chain instead of leaving this setting enabled.

## Timeouts and retries

```sh
JUP_NETWORK_TIMEOUT=60000 JUP_NETWORK_RETRIES=5 jup cache install
```

The timeout covers connecting and idle response time. Retries apply only to safe
GET requests and temporary failures, including transport errors, HTTP 408, 425,
429, and server errors. jup does not retry ordinary client errors. Retry count is
capped.

## Private-registry checklist

1. Use HTTPS.
2. Put auth in the process environment or user/global `.npmrc`.
3. Scope credentials to the narrowest host and path.
4. Install the company CA instead of disabling TLS.
5. Confirm the selected source with `jup info`.
6. Keep signature checks enabled; use `JUP_REQUIRE_SIGNATURES=1` if policy does
   not allow a registry-digest fallback.

See [Security](./security) before changing integrity settings.