Skip to main content

Configure a Connector with recipe marketplace repositories

This guide explains how to point the Moderne Connector at one or more package registries (Maven, NPM, NuGet, and PyPI) so that recipe artifacts published to those registries become available for deployment to Moderne.

Configuring the Moderne Connector​

Recipe marketplace repositories are configured under the moderne.recipe.marketplace.repositories namespace. You can configure multiple repositories of each type by including multiple entries, each with a different {index}.

The variables/arguments in the tables below must be combined with ones found in other steps in the Configuring the Moderne Connector guide.

At least one Maven repository is required

The Moderne Platform does not fall back to Maven Central or any other public registry. You must explicitly configure at least one Maven repository below that hosts every recipe artifact (and its transitive dependencies) you intend to deploy. PyPI, NuGet, and NPM have no defaults either: each ecosystem must be explicitly configured.

If you are using OpenRewrite recipes, that typically means configuring Maven Central (https://repo.maven.apache.org/maven2/, releases), Sonatype snapshots (https://central.sonatype.com/repository/maven-snapshots/, snapshots), and the Gradle release repository (https://repo.gradle.org/gradle/libs-releases/, releases), or an internal Nexus or Artifactory that mirrors them. The Gradle release repository is required for recipes that operate on Gradle build files: org.openrewrite:rewrite-gradle and the recipes that depend on it resolve org.gradle:* artifacts that are published only there, not to Maven Central, so a Maven Central mirror on its own is not sufficient.

The Moderne Platform supports recipes packaged for Maven, NPM, NuGet, and pip. The following OpenRewrite packages are the recommended starting points for each ecosystem. Once you have registered the corresponding registry below, deploy these packages from the v2 deploy page.

JavaScript and TypeScript (NPM):

  • @openrewrite/recipes-nodejs
  • @openrewrite/recipes-react
  • @openrewrite/recipes-angular

Python:

  • Maven: org.openrewrite:rewrite-python:LATEST
  • pip: openrewrite-migrate-python

C# (NuGet):

  • OpenRewrite.Recipes.CSharp.Migration.Dotnet
  • OpenRewrite.Recipes.CSharp.CodeQuality
  • OpenRewrite.CSharp
C# package dependencies

OpenRewrite.Recipes.CSharp.Migration.Dotnet and OpenRewrite.Recipes.CSharp.CodeQuality depend on OpenRewrite.CSharp and the Java org.openrewrite:rewrite-java package. You must register both for the first two to resolve. If you previously saw OpenRewrite.MigrateDotNet referenced anywhere, that is the old package name — use the three packages listed above instead.

Use internal mirrors where possible

If your organization already runs an internal NPM registry mirror, NuGet feed, or PyPI proxy, point the marketplace repositories below at those rather than the public registries. This keeps recipe resolution traffic on your network and avoids hitting public rate limits.

Maven​

Environment variables:

Variable NameRequiredDefaultDescription
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_URItrueThe URL of your Maven repository.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_USERNAMEfalsenullThe username used to resolve artifacts.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_PASSWORDfalsenullThe password used to resolve artifacts.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_PROXY_HOSTfalsenullThe host of an HTTP proxy used to reach this repository.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_PROXY_PORTfalsenullThe port of an HTTP proxy used to reach this repository.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_SKIPSSLfalsefalseWhether or not to skip SSL/TLS verification for calls from the Connector to this Maven repository. This must be set to true if you use a self-signed SSL/TLS certificate.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_RELEASESfalsetrueSpecifies whether or not this repository should be searched for releases.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_{index}_SNAPSHOTSfalsetrueSpecifies whether or not this repository should be searched for snapshots.

Example:

docker run \
# ... Existing variables
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_0_URI=https://myartifactory.example.com/artifactory/libs-releases-local \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_0_USERNAME=admin \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_0_PASSWORD=password \
# ... Additional variables

AWS CodeArtifact​

When a Maven repository URL points at an AWS CodeArtifact endpoint (<domain>-<account-id>.d.codeartifact.<region>.amazonaws.com) and you leave the password unset, the Connector mints and refreshes CodeArtifact authorization tokens itself. CodeArtifact tokens are short-lived (up to 12 hours), so this removes the need to manually generate and rotate a token before it expires. The Connector resolves AWS credentials through the default credential provider chain (IAM role, profile, environment variables, etc.), mints one token per CodeArtifact domain, and re-mints ahead of expiry so the request path does not block.

To enable it, configure the repository with its CodeArtifact URL and leave password unset; the Connector authenticates as the CodeArtifact user aws automatically. Statically configured credentials (username + password) always take precedence, so a manually minted token remains fully supported (for example, when the Connector runs without an AWS identity).

Token minting does not apply to LST or organization sources. CodeArtifact is not supported as an LST source: CodeArtifact does not serve the maven-indexer index that LST poll discovery requires, and its package assets are immutable, so the Connector rejects CodeArtifact URLs in LST and organization source configuration at startup.

Prerequisites​

The AWS identity available to the Connector must be allowed to mint tokens for your CodeArtifact domain and read from the repository:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "codeartifact:GetAuthorizationToken",
            "Resource": "arn:aws:codeartifact:<region>:<account-id>:domain/<domain>"
        },
        {
            "Effect": "Allow",
            "Action": "codeartifact:ReadFromRepository",
            "Resource": "arn:aws:codeartifact:<region>:<account-id>:repository/<domain>/<repository>"
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*"
        }
    ]
}

codeartifact:GetAuthorizationToken mints the token and is scoped to the domain. codeartifact:ReadFromRepository authorizes the artifact downloads the token is then used for, and is scoped to the repository; without it, token minting succeeds but every artifact download returns HTTP 403. sts:GetServiceBearerToken does not support resource-level restrictions and must use "*".

docker run \
# ... Existing variables
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_MAVEN_0_URI=https://my-domain-111122223333.d.codeartifact.us-east-1.amazonaws.com/maven/my-repo/ \
# ... Additional variables

NPM​

NPM repositories support either basic authentication (username + password) or bearer token authentication (bearerToken), but not both at the same time.

Environment variables:

Variable NameRequiredDefaultDescription
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_URItrueThe URL of your NPM registry.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_USERNAMEfalsenullThe username used to resolve artifacts. Mutually exclusive with BEARERTOKEN.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_PASSWORDfalsenullThe password used to resolve artifacts. Mutually exclusive with BEARERTOKEN.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_BEARERTOKENfalsenullA bearer token used to resolve artifacts. Mutually exclusive with USERNAME/PASSWORD.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_PROXY_HOSTfalsenullThe host of an HTTP proxy used to reach this registry.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_PROXY_PORTfalsenullThe port of an HTTP proxy used to reach this registry.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_{index}_SKIPSSLfalsefalseWhether or not to skip SSL/TLS verification for calls from the Connector to this NPM registry. This must be set to true if you use a self-signed SSL/TLS certificate.

Example:

docker run \
# ... Existing variables
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_0_URI=https://myartifactory.example.com/artifactory/api/npm/npm-local \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NPM_0_BEARERTOKEN=... \
# ... Additional variables

NuGet​

NuGet repositories support either basic authentication (username + password) or bearer token authentication (bearerToken), but not both at the same time.

Environment variables:

Variable NameRequiredDefaultDescription
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_URItrueThe URL of your NuGet feed.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_USERNAMEfalsenullThe username used to resolve artifacts. Mutually exclusive with BEARERTOKEN.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_PASSWORDfalsenullThe password used to resolve artifacts. Mutually exclusive with BEARERTOKEN.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_BEARERTOKENfalsenullA bearer token used to resolve artifacts. Mutually exclusive with USERNAME/PASSWORD.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_PROXY_HOSTfalsenullThe host of an HTTP proxy used to reach this feed.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_PROXY_PORTfalsenullThe port of an HTTP proxy used to reach this feed.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_{index}_SKIPSSLfalsefalseWhether or not to skip SSL/TLS verification for calls from the Connector to this NuGet feed. This must be set to true if you use a self-signed SSL/TLS certificate.

Example:

docker run \
# ... Existing variables
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_0_URI=https://myartifactory.example.com/artifactory/api/nuget/nuget-local \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_NUGET_0_BEARERTOKEN=... \
# ... Additional variables

PyPI​

Environment variables:

Variable NameRequiredDefaultDescription
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_URItrueThe URL of your PyPI index.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_USERNAMEfalsenullThe username used to resolve artifacts.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_PASSWORDfalsenullThe password used to resolve artifacts.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_PROXY_HOSTfalsenullThe host of an HTTP proxy used to reach this index.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_PROXY_PORTfalsenullThe port of an HTTP proxy used to reach this index.
MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_{index}_SKIPSSLfalsefalseWhether or not to skip SSL/TLS verification for calls from the Connector to this PyPI index. This must be set to true if you use a self-signed SSL/TLS certificate.

Example:

docker run \
# ... Existing variables
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_0_URI=https://myartifactory.example.com/artifactory/api/pypi/pypi-local/simple \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_0_USERNAME=admin \
-e MODERNE_RECIPE_MARKETPLACE_REPOSITORIES_PYPI_0_PASSWORD=password \
# ... Additional variables