BatleHub

⚡

Artifact Caching

First download is fetched from upstream and stored locally or in S3. Every subsequent request is served from cache — fast and bandwidth-free.

🔒

Private Registries

Publish private npm packages, Cargo crates, Go modules, VS Code extensions, Python wheels, conda packages, and more directly to BatleHub. Use local or hybrid mode per registry.

🛡️

Role-Based Access Control

Per-registry permissions for anonymous, user, and admin roles. Group-based access from OIDC claims, Kubernetes service accounts, or GitHub/Forgejo Actions OIDC tokens.

🤖

Actions OIDC Auth

Validate GitHub and Forgejo workflow JWTs without long-lived secrets. Map any claim — repo, branch, environment — to groups and roles via glob/regex rules. Dynamic group names like "{name}/{repository}/{ref_name}" enable wildcard RBAC grants across all CI jobs.

⏱️

Release Age Gate

Block packages published less than N seconds ago. Creates a delay window against supply-chain attacks without blocking known-good versions.

🔀

Multi-Upstream Fanout

List multiple upstreams per registry. A 404 from one automatically falls through to the next — no single point of failure.

🚦

Distributed Rate Limiting

Fixed-window per-user and per-group rate limits. Back counters with InMemory, PostgreSQL, or Redis — shared limits survive restarts and scale across replicas.

📊

OpenTelemetry

Optional distributed tracing via OTLP/gRPC. Works out of the box with Jaeger, Tempo, or any OTLP-compatible backend.

🔥

Cache Warming & Eviction

Pre-fetch packages at startup to eliminate cold-start latency. Evict by TTL, idle time, version count, or storage size cap — mix and match per registry.

🧪

Beta/Pre-Release Channel

Gate pre-release versions (e.g. 1.0.0-beta.1) to approved users or groups. Non-members see only stable versions — no separate publish step needed.

🚫

IP-Based Blocking

Fail2ban-style auto-blocking. IPs that exceed a violation threshold (rate-limit hits, auth failures) are blocked automatically. Manual ban/unban via admin API.

🗄️

Storage Deduplication

Identical artifact bytes are stored once, regardless of how many registries or package names reference them. Ref-counted and backwards-compatible.

🔑

Hashed Static Tokens

Store Argon2id PHC hashes in config instead of raw token strings. Run `batlehub hash-token ` to generate a hash. Plain-text tokens keep working — both formats coexist.

Supported registries

BatleHub proxies twelve registry types. Every registry type can run as a pure cache (proxy mode), a fully private registry (local mode), or a hybrid of both.

Registry	Protocol	Default upstream
GitHub	Releases, assets, tarballs, raw files	`api.github.com`
npm	Full packument + tarball proxy	`registry.npmjs.org`
Cargo	Sparse index + `.crate` download	`crates.io`
OpenVSX	VS Code extension VSIX	`open-vsx.org`
VS Code Marketplace	VS Code extension VSIX via Microsoft Gallery API	`marketplace.visualstudio.com`
Go	GOPROXY protocol (`.info`, `.mod`, `.zip`)	`proxy.golang.org`
Maven	Maven Central-compatible metadata XML + JAR / POM downloads	`repo1.maven.org`
Terraform	Provider and module proxy protocol (v1 API)	`registry.terraform.io`
RubyGems	Gem downloads, version listing, REST info API	`rubygems.org`
Composer	Packagist v2 protocol (`packages.json`, p2 metadata, dist downloads)	`repo.packagist.org`
PyPI	Simple Repository API (PEP 503/691) + JSON API; URL-rewriting for pip/uv/Poetry	`pypi.org`
Conda	repodata.json channel proxy; `.conda` and `.tar.bz2` package downloads	`conda.anaconda.org`

Registry

Protocol

Default upstream

GitHub

Releases, assets, tarballs, raw files

api.github.com

npm

Full packument + tarball proxy

registry.npmjs.org

Cargo

Sparse index + .crate download

crates.io

OpenVSX

VS Code extension VSIX

open-vsx.org

VS Code Marketplace

VS Code extension VSIX via Microsoft Gallery API

marketplace.visualstudio.com

GOPROXY protocol (.info, .mod, .zip)

proxy.golang.org

Maven

Maven Central-compatible metadata XML + JAR / POM downloads

repo1.maven.org

Terraform

Provider and module proxy protocol (v1 API)

registry.terraform.io

RubyGems

Gem downloads, version listing, REST info API

rubygems.org

Composer

Packagist v2 protocol (packages.json, p2 metadata, dist downloads)

repo.packagist.org

PyPI

Simple Repository API (PEP 503/691) + JSON API; URL-rewriting for pip/uv/Poetry

pypi.org

Conda

repodata.json channel proxy; .conda and .tar.bz2 package downloads

conda.anaconda.org

Feature	GitHub	npm	Cargo	OpenVSX	VS Code	Go	Maven	Terraform	RubyGems	Composer	PyPI	Conda
Version listing	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓ ¹
Source archive	✓	✓	✓	—	—	✓	✓	✓	✓	✓	✓	✓
Binary / extension	✓	—	—	✓	✓	—	✓	✓	—	—	✓	✓
Private publish	—	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓
Multi-upstream fanout	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓
Release age gate	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	⚠ ²
RBAC	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓	✓
Cache warming (version enumeration)	✓	✓	✓	✓	✓	✓	—	—	—	—	✓	✓ ¹

Feature

GitHub

npm

Cargo

OpenVSX

VS Code

Maven

Terraform

RubyGems

Composer

PyPI

Conda

Version listing

✓

✓ ¹

Source archive

✓

—

✓

Binary / extension

✓

—

✓

—

✓

—

✓

Private publish

—

✓

Multi-upstream fanout

✓

Release age gate

✓

⚠ ²

RBAC

✓

Cache warming (version enumeration)

✓

—

✓

✓ ¹

¹ Conda has no dedicated per-package version listing API. BatleHub synthesises one by scanning repodata.json for noarch, linux-64, osx-64, osx-arm64, and win-64. Results are the union of versions found across all available platforms.

² Conda timestamps come from the timestamp field in repodata.json (ms since epoch). Most packages carry it; packages without one skip the gate by default. Set deny_missing_timestamp = true on the rule to block packages with no timestamp instead.

BatleHubYour package hub. Proxy, cache, and host.