BaGetter Private NuGet Package Feed Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This AMI Instead of Self-Deploying?

BaGetter is a lightweight, self-hosted, open source NuGet package feed server. It hosts your organisation's private .NET packages, exposes the standard NuGet v3 service index that any NuGet client can restore from, and provides a browsable web gallery for discovering what is published. Deploying it yourself means installing a .NET runtime, building or publishing the application, running it as a hardened service, generating and wiring up a push API key so the feed is not open to anonymous uploads, and putting a TLS reverse proxy in front so the gallery and API are never served in the clear. This AMI eliminates that effort entirely - a working, secured NuGet feed is running within minutes of launch, not hours, and is backed by 24/7 expert support.

The current release available is BaGetter 1.6.5.

## What This Image Ships

BaGetter is served by a dedicated unprivileged system user under systemd with automatic restarts, clean logging and a hardened service sandbox. It stores package metadata in SQLite and package content on the filesystem, both placed on a dedicated data volume that is separate from the operating system disk so your published packages are independently resizable and snapshottable. The web gallery and the NuGet v3 API are the same standard endpoints every NuGet client already understands, so pushing and restoring packages works with the tools your developers use today.

## Secure By Default

A stock NuGet server can accept anonymous package uploads if no push key is configured, which means anyone who can reach it can publish or overwrite packages. This image eliminates that risk:

• BaGetter binds to the loopback address only and is fronted by an nginx TLS reverse proxy, so the application is never directly reachable from the network and all traffic to the gallery and API is encrypted
• The recommended security group opens only SSH (22) and the HTTPS front door (443); scope both to your own developer or administrator network
• A unique push API key is generated on every instance's first boot and placed in a root only file for the administrator to read; no usable key is baked into the image, so no two deployments share a credential
• A push with a missing or wrong API key is rejected, while read access - the service index, package restore and the gallery - stays open by design, which is the standard private feed posture
• A unique self-signed TLS certificate is generated per instance on first boot; replace it with your own certificate or terminate TLS at a load balancer

## Ready To Use

Browse to the instance over HTTPS on port 443 to explore the gallery, add the service index as a restore source in your NuGet client, and push packages with the generated API key. An unauthenticated health endpoint is provided for load balancer probes, so monitoring needs no credential even though package push does.

## What You Avoid By Using This AMI

• Installing a .NET runtime and publishing the application
• Running BaGetter as a hardened, unprivileged systemd service on a dedicated data volume
• Generating a push API key and testing that anonymous uploads are actually refused
• Standing up a TLS reverse proxy in front of the feed
• Ongoing maintenance and security patching without expert guidance

## cloudimg Support

24/7 technical support by email and chat with a one-hour average response for critical issues. Our engineers help with deployment, connecting NuGet clients, TLS termination, upstream mirroring, backups and scaling.

## Use Cases

• A private, in-your-own-VPC NuGet feed for an organisation's internal .NET packages with full data ownership
• A CI/CD artifact store that build pipelines push to and that developer machines restore from over an encrypted, API-key-protected feed
• A cached mirror of upstream NuGet packages so builds do not depend on public availability

BaGetter is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.