Packeton Private Composer Repository on AWS User Guide

Overview

Packeton is a free, open source, self hosted private Composer package repository for PHP, your own private Packagist. It hosts private Composer packages, proxies and mirrors packages from public sources, integrates version control repositories over git, subversion and mercurial, and serves package metadata and zipball archives to composer clients, with per user API tokens and fine grained permissions controlling who can read and publish. This cloudimg Amazon Machine Image delivers Packeton fully installed and configured as a Symfony application on PHP 8.3, served by nginx and backed by a local PostgreSQL database and a local Redis instance, so a complete private package repository is serving within minutes of launch, with your private code staying on infrastructure you control. Backed by 24/7 cloudimg support.

Packeton is licensed under the MIT License. All product and company names are trademarks or registered trademarks of their respective holders. This image repackages the upstream open source release with cloudimg's provisioning and support.

What is included:

• Packeton 2.7.0 (MIT), served from /var/www/packeton
• PHP 8.3 (php8.3-fpm) + nginx, with the web UI and Composer repository endpoints on port 80
• A local PostgreSQL 16 database and a local Redis instance, both bound to localhost only
• A background worker (packeton-worker.service) and a one minute cron timer that keep repository metadata and package updates current
• A per-instance administrator password, a fresh application secret and a rotated database password, all generated on first boot and written to a root-only file, so no default or shared credentials ship in the image
• postgresql, redis-server, php8.3-fpm, nginx and packeton-worker as systemd units, enabled and active

Architecture at a glance

The database tier and the application tier each live on their own independently-resizable EBS volume, separate from the operating-system disk, so you can grow storage for either tier without disturbing the other. Both PostgreSQL and Redis are bound to 127.0.0.1, so no database or cache port is exposed to the network.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating-system variant.

ssh -i /path/to/your-key.pem ubuntu@<instance-public-ip>

Replace <instance-public-ip> with the public IPv4 address of your instance (visible in the EC2 console) and /path/to/your-key.pem with the private key you launched the instance with. Open 80/tcp (and 443/tcp if you enable HTTPS) to your developers in the instance's security group, and 22/tcp from your management network.

Confirm the Packeton stack is running

Packeton is served by nginx on port 80, in front of php8.3-fpm, and backed by a local PostgreSQL database and a local Redis instance. A background worker keeps repository metadata current.

for u in postgresql redis-server php8.3-fpm nginx packeton-worker; do
  printf '%-22s %s\n' "$u:" "$(systemctl is-active $u)"
done

All five units report active, and only nginx listens on a public port.

Retrieve the first-boot administrator credentials

On the first boot of your instance, a one shot service generates a fresh application secret, rotates the PostgreSQL password, builds the database schema and sets a fresh administrator password, writing the credentials to a root-only file. Read them with:

sudo cat /root/packeton-credentials.txt

The file is mode 0600 and owned by root, and the administrator password is unique to this instance.

Sign in to the web UI

Browse to http://<instance-public-ip>/login and sign in as the generated administrator (username admin). Packeton presents its Packagist-style package browser.

Host a private Composer package

Choose Submit to add a package from a version control repository. Packeton supports git, subversion and mercurial: paste a repository URL, click Check, and Packeton reads the package name from the composer.json on the default branch and begins tracking it.

Once indexed, each package has its own page with its composer require line, its published versions and update controls. The repository serves this to composer clients as standard Composer v2 (p2) metadata and zipball dists.

Manage users and issue API tokens

Manage users, roles and access from Settings → Users. Each user carries API tokens on their profile page; a token authenticates composer against your private repository over HTTP basic auth (username:token).

You can confirm the repository serves Composer metadata from the instance using the administrator's API token:

TOKEN=$(sudo -u postgres psql -tAc "SELECT apitoken FROM fos_user WHERE username='admin'" packeton | tr -d '[:space:]')
curl -s -o /dev/null -w 'GET /api/healthz: HTTP %{http_code}\n' http://127.0.0.1/api/healthz
curl -s -u "admin:$TOKEN" http://127.0.0.1/packages.json | head -c 400; echo

Packeton returns the Composer repository descriptor (metadata URL, mirrors and dist URLs). To consume the repository from a developer workstation, add it to your project composer.json and provide the token when prompted:

composer config repositories.packeton composer http://<instance-public-ip>/
composer require your-vendor/your-package

Version and stack

The image ships Packeton 2.7.0 on PHP 8.3, PostgreSQL 16, Redis and nginx, with the first-boot secret-rotation service enabled:

echo -n 'Packeton version: '; grep -oE '"version": *"[0-9.]+"' /var/www/packeton/composer.json | head -1 | grep -oE '[0-9.]+' || echo 2.7.0
php -v | head -1
sudo -u postgres psql -tAc 'SHOW server_version'

The first-boot security model

No shared or default credentials ship in the image. On first boot, packeton-firstboot.service:

• generates a fresh per-instance APP_SECRET,
• rotates the PostgreSQL packeton role password to a fresh per-instance value and writes it into /var/www/packeton/.env.local,
• builds the database schema,
• sets a fresh per-instance administrator password, and
• writes the credentials to /root/packeton-credentials.txt (root only, 0600).

You can confirm first boot completed and the credentials are protected:

sudo systemctl is-active packeton-firstboot.service
sudo stat -c '%a %U:%G' /root/packeton-credentials.txt

Enable HTTPS with a custom domain (recommended)

Point a DNS A record at your instance's public IP, then install a Let's Encrypt certificate with certbot. Open 443/tcp in your security group first.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d packages.your-domain.com

Certbot obtains the certificate and reconfigures nginx to serve Packeton over HTTPS and redirect HTTP to HTTPS. Packeton auto-detects the request host, so no application configuration change is needed.

Maintenance

• Change the administrator password from the web UI (profile → change password), or from the CLI:

text sudo -u www-data php /var/www/packeton/bin/console packagist:user:manager admin --password

• Add more users from Settings → Users in the web UI, or with packagist:user:manager <username> --email=<email> --password.
• Security updates are applied automatically by Ubuntu's unattended-upgrades. The Packeton application, PHP, PostgreSQL, Redis and nginx are managed by systemd and restart on failure.
• Back up the PostgreSQL packeton database and the stored zipballs under /var/www/packeton/var/zipball.

Support

cloudimg provides 24/7 support for this image by email (support@cloudimg.co.uk) and live chat, covering deployment, first-boot credential retrieval, VCS integration, API tokens, mirroring, HTTPS and custom domains, upgrades and troubleshooting. For billing or subscription changes, contact support@cloudimg.co.uk.