Mirrors

Our projects often use various repositories. To simplify & speed up your build process, you can list all of these repositories in Mirrored repositories section and Reposilite will also search for requested artifacts among them:

Note: Remember about increasing disk quota! Caching may allocate thousands of artifacts, especially at the beginning - for the first few builds.

§ Mirror configuration

Each proxied repository has individual configuration that can be adjusted to your needs:

§ Link

The link property can handle 2 types of values:

URL - direct link to remote repository, for example: https://repo.maven.apache.org/maven2/
Local ID - ID of another local repository, for example: releases

§ Store

By default, proxied artifacts are not stored in the repository. If you want to improve response time or availability, you can enable storing artifacts in the local repository.

§ Storage policy

You can configure the storage policy of proxied artifacts.

Name	Description
PRIORITIZE_UPSTREAM_METADATA	(Default) Try to fetch the latest version of the artifact from the remote repository
STRICT	Prioritize cached version over upstream metadata (full offline mode)

Note: This property can be only set for a whole repository.

§ Allowed groups

You can limit the scope of proxied artifacts by specifying list of allowed groups, e.g.:

org.reposilite

If the list is empty, all groups are allowed.

§ Blocked groups

You can also block specific groups from being proxied through this mirror, e.g.:

com.internal

Groups listed here are never requested from this mirror. Blocked groups take precedence over allowed groups, so a group that appears in both lists is blocked.

Mirrors are consulted in the order they are configured, and the first one to answer wins. Two situations follow from that:

Steering resolution. When two mirrors carry the same group at different versions, block the group on the mirror that should not answer for it, and resolution falls through to the mirror that should.
Dependency confusion. If someone publishes an artifact under one of your internal groups to a public repository you proxy, that mirror may answer ahead of the mirror that should serve the group. Blocking your internal groups on every public mirror removes that possibility.

Matching is a path prefix, so com.acme also blocks com.acmecorp - prefer the most specific group you can.

Blocking a group only suppresses the upstream fetch. Artifacts already stored locally under a blocked group still resolve normally from local storage, so blocking prevents future fetches rather than retracting past ones - delete the cached artifact as well if you need it gone.

When a mirror's Link references another local repository by ID rather than a URL, blocking a group on that entry also suppresses reads of the referenced repository's cached artifacts. For that reason, blockedGroups belongs on mirror entries whose Link is a URL.

§ Allowed extensions

You can limit the scope of proxied artifacts by specifying list of allowed extensions. By default, Reposilite allows these extensions:

.jar
.war
.aar
.xml
.pom
.module
.asc
.md5
.sha1
.sha256
.sha512

§ Timeouts

If your repository requests remote repository that is often unable to respond in time, you can increase the timeout value to prevent such issues.

Name	Description	Default
Connect	Time required to establish a connection	`3s`
Read	How long Reposilite can read the data from remote host	`15s`

§ Credentials

Mirrored proxy may require authentication to access the repository. Reposilite supports 3 types of authentication:

§ Basic

Basic authentication is the simplest method to authenticate the user. It requires username and password to access the repository.

Login: Admin
Password: Secret

Some repositories may require authentication via a custom header & some kind of API key. You can configure Reposilite to use such authentication by specifying header name and value:

Login: X-Api-Key
Password: Token

§ Loopback link

Since Reposilite 3.4.x, private local repositories requires dedicated authentication as well. This enhanced security layer prevents accidental access to private repositories.

If you want to proxy private local repository to another local repository (public or private), you should generate a new token that has access to the proxied repository (requires read permission):

Login: reposilite-proxy-token
Password: secret

§ Proxy

Reposilite supports 2 type of proxies:

HTTP, for instance:

HTTP 127.0.0.1:1081

SOCKS, e.g.:

SOCKS 127.0.0.1:1080 login password

§ Proxying Maven Central

Maven Central enforces consumption limits and may respond with 429 Too Many Requests. Usage is aggregated by public network address, so other services using the same shared egress may contribute to the limit. See

Maven Central's guidance on 429 responses

for more information.

Adding Maven Central as a mirror does not enable artifact storage by default. For a repository that broadly proxies Maven Central, we recommend starting with:

Link: https://repo.maven.apache.org/maven2/
Store: enabled on the mirrored repository
Max age of metadata file: between 300 and 3600 seconds, depending on the required metadata freshness
Resolution cache size: 2048 or more on Reposilite 3.6+

The metadata max age and resolution cache size are configured on the repository, while storing is enabled on its Maven Central mirror entry. Together, these settings reduce repeated requests to Maven Central, but cannot prevent rate limiting caused by other traffic using the same public network address.

An upstream 429 response may currently be exposed to clients as 406 Not Acceptable. Some older Reposilite versions may report 404 Not Found after trying the remaining mirrors instead. Check the Reposilite server logs to identify the original Maven Central response.

We are exploring further improvements to make proxying Maven Central more reliable.

Did you find misleading or deprecated content? Maybe you just feel this section misses important elements?