bagetter / BaGetter

A lightweight NuGet and symbol server
https://www.bagetter.com
MIT License
269 stars 57 forks source link

Packages should not be downloaded without API Key #168

Closed devops-slash closed 3 months ago

devops-slash commented 3 months ago

Is your feature request related to a problem? Please describe.

A clear and concise description of what the problem is.

I know, it doesn't support private feed yet but packages should not be downloadable without API Key atleast.

Describe the solution you'd like

A clear and concise description of what you want to happen.

Describe alternatives you've considered

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

Regenhardt commented 3 months ago

As the nuget client does not support authenticating via API key, we won't implement that as a feature.

We currently don't have much time, but one of if not the next thing we will add is private feeds via basic http authentication in #156, you can subscribe either there to be notified once it's merged, or to the BaGetter repo to get notified once the next release is created, or on discord to get notified when the update is released. Once that is done, we can talk about what's next, like adding the same authentication to the web GUI, which currently supports no authentication at all.

If you have packages that cannot be available publicly, currently you'd have to restrict access to BaGetter to a local network and accessing that via VPN when working remotely. Or use a reverse proxy and add authentication on that layer.