Setting up repositories with Composer

This is the third in a series of blog posts addressing a package manager named Composer, greatly facilitating any web developer’s work. In my previous posts, I have explained how to start using composer.phar, and we also took a brief look at the most common commands. Next, we will answer the following question: how can you use Composer to install a package you have created yourself, and make another package dependent on it?

When installing dependencies using the composer install command, it will first search the public packagist.org registry for the respective package information. If you want to be able to install your homespun packages using the same command, there are several options.

Packagist.org

If the application concerned is open source, you can register it in the public packagist.org registry, that will scan the publicly available Git repository either manually or automatically by using a webhook. The package is then installed without requiring any additional activities. You must only use a unique package name for this.

Setting up a composer.json file

Private Git repositories can also be set up directly in the composer.json file created for the project that is going to have the corresponding dependency. To do this, you need to set up the desired packages in the repositories slot.

{
    "repositories": [
        {
            "type": "vcs",
            "url":  "git@minu-git-aadress.org:vendor/minut-git-repo.git"
        }
    ],
    "require": {
        "vendor/minut-git-repo": "dev-master"
    }
}Code language: JSON / JSON with Comments (json)

By the way – the described solution also supports Subversion, Mergurial and Fossil in addition to Git.

Using a private registry

If you have multiple private packages and managing them via composer.json files is starting to get complicated, you can also use your own registry. There are also several options for this. You can for example use the paid Private Packagist service, which also helps to monitor security vulnerabilities when managing public dependencies and mirror the code in case a library is not available when you need it.

As an alternative, you can also host such a registry yourself. A good tool for this is e.g. Satis running on our Zone hosting software. Satis will create a static registry for Composer, readable by using its configuration file.

Installing Satis

First, we will install Satis on the virtual server. In order to do this, we will log in to the server over SSH and navigate to the domain’s home directory:

cd domains/www.miljonivaade.euCode language: Bash (bash)

After that we will install the application:

# let’s clone the Satis git repository
git clone https://github.com/composer/satis.git

# let’s install the required dependencies 
cd satis
composer install

# let's create a directory for displaying repositories
mkdir public

Setting up the web server

In order to publish the repository, we will add a subdomain named satis.miljonivaade.eu to our server and set satis/public as the value of the Directory on the server parameter.

Configuring Satis

We will then create a satis.json file on the server and place it one level above the directory serving the subdomain i.e. in the satis directory. One part of the file is the general registry setup, and another part is the array of the repositories you wish to include. These parts have exactly the same structure as the repositories slot of composer.json.

The content of this file could look something like that:

{
    "name": "my/repository",
    "homepage": "https://satis.miljonivaade.eu",
    "repositories": [
        {
            "type": "vcs",
            "url":  "git@minu-git-aadress.org:vendor/minut-git-repo.git"
        }
    ],
    "require-all": true
}Code language: JSON / JSON with Comments (json)

All repositories you want to add to your registry must be set up in the repositories slot of this file.

Launching Satis

In order to start using your registry, you need to generate the registry based on your configuration file. The command in question will look in all your configured Git repositories and create the corresponding content that can be displayed from the web. Run the following command in the satis directory to do this:

php bin/satis build satis.json publicCode language: Bash (bash)

When you then open the satis.miljonivaade.eu subdomain in your web browser, you will see the created registry and the available packages. You can find more detailed configuration options in the documentation. How to use the documentation is explained in more detail also in Satis documentation. We will not, however, configure it in this example so we could keep this description simple.

Putting your private registry to use

In order to be able to use the packages included in your registry you must configure the composer.json subdomain for the corresponding package:

        "repositories": [
        {
            "type": "composer",
            "url": "https://satis.miljonivaade.eu"
        }
    ]Code language: JSON / JSON with Comments (json)

After that you can install the packages made available with this registry.

In addition

Although we now have a fully operational private registry you can use with Composer, you should still pay attention to a few more aspects.

1. Authentication

Restricting access to your subdomain e.g. by allowing only IP addresses associated with the servers using this registry would be a good idea, or you could set up HTTP basic auth password authentication.

2. Automatic updates

In order to enable automatic updating of the repository registry, I suggest adding the update command cd www.miljonivaade.eu/satis && [[$PHP]] bin/satis build satis.json public under the periodic jobs and run it with a reasonable frequency – for example daily, depending on how often the respective packages might be updated.

3. Package mirroring

In order to take the reins in your own hands and not depend on Github, you can also mirror your configured packages on the same Satis server. This will also reduce the volume of external network traffic and make installation faster internally for Zone services. By the way – you can also mirror public packages using Satis.

In order to use mirroring you must add the following lines to your satis.json file:

...
    "archive": {
        "directory": "dist",
        "format": "tar",
        "skip-dev": true
    }
...Code language: JSON / JSON with Comments (json)

These packages will be installed in the public folder on the next startup. However, you should also keep in mind that the disk capacity of your virtual server is limited, and install only necessary repositories for mirroring.