Kellnr Crate Registry on Ubuntu 24.04
by cloudimg
A private cargo registry with per instance credentials and no default password.
Kellnr is an open source private registry for Rust crates: a crates.io you run yourself, for code your team does not publish to the world. It speaks the registry protocol cargo already knows, so publishing an internal crate is cargo publish and depending on one is an ordinary dependency line pointing at your own registry. It serves the sparse index cargo fetches, stores and returns the crate files themselves, and includes a web interface for browsing what has been published, managing users and read-only accounts, and issuing and revoking API tokens.
What you get. Kellnr 6.8.0 on Ubuntu 24.04 LTS, the unmodified upstream release binary pinned by tag and by SHA-256, run by systemd as an unprivileged service account. The registry is served over TLS with a certificate generated for your instance, and authentication is required on every registry operation: the index, crate downloads and publishing all demand a token, so a private registry is genuinely private rather than merely unadvertised. Crates and their metadata live on a durable path owned by a dedicated service account. A working registry is available within minutes of launch with no manual configuration.
No shared credential, and no default left behind. Kellnr's upstream defaults include a published administrator password, and that credential is fixed the moment the registry database is created. This image ships no registry database at all, so the default never exists on a running instance: on each instance's first boot a unique administrator password, a unique cargo API token and a unique session signing key are generated for that instance alone and written to a file only the root user can read. The registry stays closed until that has finished. No two deployments share a credential, and the well-known default is refused.
The URLs are correct out of the box. cargo does not use the address you typed to download crates; it follows the download and API URLs published in the registry index. A self-hosted registry that ships the defaults tells every client to fetch from an address that only resolves on the registry host. This image resolves the instance's own public address on first boot and publishes it over HTTPS, so cargo works from a developer machine immediately.
Hardened beyond the defaults. Upstream binds the registry to every interface and leaves authentication optional; here it never leaves the loopback interface and authentication is mandatory. Only SSH and HTTPS are reachable from outside the instance, and there is no plaintext port at all. No compiler toolchain is installed, because a registry is used from a developer machine rather than from itself. An on-instance self test publishes a crate through the real front door, reads it back byte for byte, removes it and confirms the registry is empty again, and each of its checks is itself tested against a known-bad input first.
Licensing and trademarks. Kellnr is free software under the Apache License 2.0, with no subscription or licence key. Kellnr and Rust are trademarks of their respective owners. All product and company names are trademarks or registered trademarks of their respective holders; cloudimg is not affiliated with, endorsed by or sponsored by the Kellnr project, the Rust Foundation or the Rust project, and packages the unmodified open source software. The cloudimg charge of $0.04 per vCPU/hour covers packaging, hardening and 24/7 support.