How to Set Up and Use PackVault: A Private PHP Package Management Panel

Overview

PackVault is a PHP private package management panel that currently supports GitHub and Gitee and can theoretically work with any Git‑based platform. It is useful for protecting and managing your own Composer packages.

Repository:

https://github.com/JaguarJack/packvault

Features

Supports GitHub and Gitee platforms

Repository management

License management

User management

Private package build tasks

Configuration

Basic Settings

# Private package domain
PACKVAULT_DOMAIN=
# Enable broadcast (requires Reverb)
PACKVAULT_USE_BROADCAST=

Reverb Settings

REVERB_APP_ID=
REVERB_APP_KEY=
REVERB_APP_SECRET=
REVERB_HOST="127.0.0.1"
REVERB_PORT=8001
REVERB_SCHEME=http
REVERB_SERVER_PATH=

Git Platform Settings

# GitHub configuration
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_CALLBACK=

# Gitee configuration
GITEE_CLIENT_ID=
GITEE_CLIENT_SECERT=
GITEE_CALLBACK=

# Gitea configuration (reserved)
GITEA_CLIENT_ID=
GITEA_CLIENT_SECERT=
# Gitea instance URL (self‑hosted)
GITEA_INSTANCE_URI=

How to Use

composer install
npm install
php artisan migrate
php artisan db:seed
php artisan key:generate
# Start local development
composer run dev
# Start queue listener
php artisan queue:listen --timeout=3000
# Start Reverb (if configured)
php artisan reverb:start --host="127.0.0.1" --port="8001" --debug

Default Login User

Email: [email protected]

Password: packvault

Remember to change the default login credentials.

Queue Configuration

Use Supervisor to manage the queue workers.

Reverb Production Configuration

Configure Reverb settings appropriate for a production environment.

Scheduled Tasks

Because Gitee limits token lifespan, a cron job is needed to refresh the access token.

* * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1

Nginx Deployment

server {
    listen 443 ssl http2;
    server_name your-domain;
    index index.html index.php index.htm default.php default.htm default.html;
    root /your-project/public;

    ssl_certificate your-cert.pem; # path to PEM file
    ssl_certificate_key your-key.key; # path to key file
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4:!DH:!DHE;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # PackVault location
    location ~ ^/packvault {
        alias /your-project/storage/packvault;
        try_files $uri $uri/index.html =404;
    }

    # Reverb proxy
    location ~ ^/apps? {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header Scheme $scheme;
        proxy_set_header SERVER_PORT $server_port;
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass reverb:port;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri /index.php =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Deny access to sensitive files
    location ~* \.(env|log|git) {
        deny all;
        return 404;
    }

    access_log /var/log/nginx/xxxx_access.log;
    error_log /var/log/nginx/xxxx_error.log;
}

Composer Repository Configuration

{
    "repositories": [
        {
            "type": "composer",
            "url": "your-domain/packvault",
            // adjust according to Nginx config
            "only-dist": true,
            "options": {
                "ssl": {
                    "verify_peer": false,
                    "verify_peer_name": false
                }
            }
        }
    ]
}