yggvault: Mirror Your Dependencies in One Binary | Hackaday.io

Close

0%

0%

yggvault: Mirror Your Dependencies in One Binary

A self-hosted mirror for Go modules, Composer packages, and source archives, with local storage, web UI, and Yggdrasil mesh access.

SUNsung

Following

Follow project

Liked

Like project

Become a Hackaday.io member

Not a member? You should<br>Sign up.

Already have an account?<br>Log in.

Sign up with Github

Sign up with Twitter

OR

Remember me

Sign up

Forgot your password?

Just one more thing

To make the experience fit your profile, pick a username and tell us what interests you.

Pick an awesome username

hackaday.io/

Your profile's URL: hackaday.io/username . Max 25 alphanumeric characters.

Pick a few interests

Projects that share your interests

People that share your interests

We found

and

based on your interests.

Choose more interests.

OK, I'm done!

Skip

Join this project

Similar projects worth following

comments

followers

likes

Description

Details

Files 0

Components 0

Logs 6

View all

Instructions 10

View all

Discussion 0

View Gallery

Team<br>(1)

SUNsung

Join this project's team

Repository

Life node

Releases

completed project

Software

self-hosted

package-manager

dependency-management

golang

COMPOSER

source-archives

homelab

devops

mesh-network

yggdrasil

p2p

single-binary

This project is submitted for

Hackaday.com Tip Line

This project was

created on 07/16/2026

and last updated 10 hours ago.

Description

Builds should not fail just because an upstream forge is down, rate-limited, blocked, or unreachable from your network.

yggvault is a self-hosted dependency mirror packed into a single binary. It mirrors selected projects from GitHub, GitLab, Bitbucket, Gitea, or another yggvault node, stores them locally, and republishes them as Go module proxy routes, Composer metadata, stable source archives, JSON/OpenAPI, Atom feeds, and a small web UI.

It can also serve the same endpoints over an embedded Yggdrasil mesh address, so a home lab or private network can keep a reachable package mirror without DNS, public IPs, port forwarding, root access, or a separate system daemon.

Details

Two in the morning, and the CI pipeline is failing. The code hasn't changed; the tests passed yesterday. The upstream forge returned a 429 for a source-archive request — the tag is there, the sources are there, but you can't download them. The build is stuck until someone else's server recovers.<br>Sound familiar? A forge can go down, move, hit a rate limit, or simply be unreachable from your network. An ordinary local cache saves one machine and one package manager. For everything else, you need a separate release endpoint that you control.<br>I first ran into this about five years ago: GitHub blocked a repository that my projects depended on. The dependencies broke instantly. That same evening I wrote a minimal server that downloaded the releases I needed and served them locally. Over the years, that evening script grew into yggvault — a full-fledged tool with several ecosystems, built-in storage, and a mesh network. More on the motivation in Why release mirroring matters.<br>What yggvault does<br>The operator lists specific projects and their upstream URLs in the configuration. yggvault pulls releases from GitHub, GitLab, Bitbucket, Gitea, and other git forges, validates the archives, stores them in local storage (SQLite + Pebble), and republishes them through a set of ready-made endpoints:<br>Go module proxy — standard GOPROXY-compatible routes, including major-version paths and optional rewriting of import paths to the mirror's address;<br>Composer v2 repository — metadata and packages for PHP projects;<br>Universal archives — .zip and .tar.gz with a stable root directory;<br>JSON API and OpenAPI — for automation;<br>Atom feeds — a global and a per-project update feed;<br>Web UI — catalog, package pages, install snippets, hashes, and archive links.<br>The project grew out of a need for Go modules and manual archive downloads — Composer came along for the ride, and universal archives cover the standardized download schemes of Zig, Bazel, and anything else distributed as .zip/.tar.gz.<br>One process, one binary. No JVM, no external database, no object storage. The hot artifact cache is rebuilt from storage on demand — if the upstream is temporarily unavailable, already-stored versions keep being served. Pipeline details are in Import and refresh pipeline, storage details in Storage internals.<br>What it looks like<br>The web interface shows a catalog of mirrored projects with versions, source information, hashes, install commands, and direct archive links. The same data is available programmatically: JSON API, OpenAPI document, Go proxy routes, Composer metadata, Atom feeds. The full route map is in Web/API routes and nested mode.<br>Try it in three steps<br>1. Download the binary<br>Prebuilt builds on GitHub Releases for Linux, macOS, Windows, and FreeBSD (10 platforms, including ARM and...