nixpacks NPM_TOKEN for private npm package

[benjaminpreiss]

Hey y'all,

It seems that I can't install private npm packages on nixpack, even though I have set NPM_TOKEN as an env variable.
Does anyone here have a workaround for that?

Glad for help!

[alexanderfink]

Have you found a solution for this? I have the issue that when I request private repositories they always timeout?

EDIT: See my solution below.

[benjaminpreiss]

Hey, yes.

I ended up doing it with docker-compose.
The below approach is also a little bit more complex, because I use infisical to load the env variables.

Here is my Dockerfile:

FROM node:20-slim AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"
RUN corepack enable

# Install curl and add Infisical CLI
RUN apt-get update && apt-get install -y curl
RUN curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash
RUN apt-get update && apt-get install -y infisical

COPY . /app
WORKDIR /app

# Define ARGs that will be used across stages
ARG NODE_ENV
ENV NODE_ENV=${NODE_ENV:-production}

RUN --mount=type=secret,id=infisical_client_id \
    --mount=type=secret,id=infisical_client_secret \
    --mount=type=secret,id=infisical_project_id \
    --mount=type=cache,id=pnpm,target=/pnpm/store \
    infisical run \
        --token=$(infisical login --method=universal-auth \
            --client-id="$(cat /run/secrets/infisical_client_id)" \
            --client-secret="$(cat /run/secrets/infisical_client_secret)" \
            --silent --plain) \
        --projectId="$(cat /run/secrets/infisical_project_id)" \
        --env="prod" \
        -- bash -c 'pnpm config set "//registry.npmjs.org/:_authToken" "${NPM_TOKEN}" && \
            pnpm install --prod=false --frozen-lockfile --ignore-scripts && \
            pnpm config delete "//registry.npmjs.org/:_authToken"'

FROM base AS build
# Read ARGs and set as ENV
ARG NODE_ENV
ENV NODE_ENV=${NODE_ENV:-production}

RUN --mount=type=secret,id=infisical_client_id \
    --mount=type=secret,id=infisical_client_secret \
    --mount=type=secret,id=infisical_project_id \
    export INFISICAL_TOKEN=$(infisical login --method=universal-auth \
        --client-id="$(cat /run/secrets/infisical_client_id)" \
        --client-secret="$(cat /run/secrets/infisical_client_secret)" \
        --silent --plain) && \
    export INFISICAL_PROJECT_ID="$(cat /run/secrets/infisical_project_id)" && \
    pnpm --filter frontend... build

FROM base
# Read ARGs and set as ENV in final stage too
ARG NODE_ENV
ENV NODE_ENV=${NODE_ENV:-production}
ENV INFISICAL_CLIENT_ID=""
ENV INFISICAL_CLIENT_SECRET=""
ENV INFISICAL_PROJECT_ID=""

COPY --from=build /app /app
EXPOSE 3000
CMD export INFISICAL_TOKEN=$(infisical login \
    --method=universal-auth \
    --client-id="${INFISICAL_CLIENT_ID}" \
    --client-secret="${INFISICAL_CLIENT_SECRET}" \
    --silent --plain) && \
    pnpm start

Then the docker-compose:

version: "3.8"

services:
    app:
        build:
            context: .
            dockerfile: Dockerfile
            args:
                - NODE_ENV=${NODE_ENV:-production}
            secrets:
                - infisical_client_id
                - infisical_client_secret
                - infisical_project_id
        environment:
            - INFISICAL_CLIENT_ID=${INFISICAL_CLIENT_ID}
            - INFISICAL_CLIENT_SECRET=${INFISICAL_CLIENT_SECRET}
            - INFISICAL_PROJECT_ID=${INFISICAL_PROJECT_ID}
        ports:
            - "3000:3000"

secrets:
    infisical_client_id:
        environment: INFISICAL_CLIENT_ID
    infisical_client_secret:
        environment: INFISICAL_CLIENT_SECRET
    infisical_project_id:
        environment: INFISICAL_PROJECT_ID

[benjaminpreiss]

Note, that the NPM_TOKEN should be set and deleted (pnpm config delete) so that it is not peristed in the container build (which others can read if you publish to the registry)

[monolithed]

Here is my workaround:

save-exact=true

registry=https://registry.npmjs.org
@example:registry=https://nexus.example.com/repository/your-npm-registry/
//nexus.example.com/repository/your-npm-registry/:_auth=${NPM_AUTH_TOKEN}

docker build . -t test:1.0 --no-cache --secret id=NPM_AUTH_TOKEN,env=NPM_AUTH_TOKEN

WORKDIR /app
COPY .npmrc ./

RUN --mount=type=secret,id=NPM_AUTH_TOKEN \
    sh -c "export NPM_AUTH_TOKEN=$(cat /run/secrets/NPM_AUTH_TOKEN) && npm ci"

[sebb3]

I found a solution!

Example buildplan.toml (the bulk of mine I got by running 'nixpacks plan', but I made a few additions):

providers = []
buildImage = 'ghcr.io/railwayapp/nixpacks:ubuntu-1727136237'

[variables]
CI = 'true'
NIXPACKS_METADATA = 'node'
NODE_ENV = 'production'
NPM_CONFIG_PRODUCTION = 'false'
PORT = '1337'
FLAG_PROMOTE_EE = 'false'
# Either set the token here, or pass it through the invocation, in my case I pass my GITHUB_TOKEN in the build step, renaming it to NPM_TOKEN. i.e:
NPM_TOKEN = 'sdfsdfsdfsdf'

[phases.build]
dependsOn = ['install']
cmds = ['npm run build']
cacheDirectories = ['node_modules/.cache']

[phases.install]
dependsOn = ['setup']


# First two cmds populates necessary .npmrc

cmds = [
    'echo "@YOUR_SCOPE:registry=https://npm.pkg.github.com" >> /root/.npmrc',  # <<--
    'echo "//npm.pkg.github.com/:_authToken=$NPM_TOKEN" >> /root/.npmrc', # <<--
    'npm ci',
]
cacheDirectories = ['/root/.npm']
paths = ['/app/node_modules/.bin']


[phases.login]


[phases.setup]
nixPkgs = ['nodejs_20', 'npm-9_x']

nixLibs = ['gcc-unwrapped']
nixOverlays = [
    'https://github.com/railwayapp/nix-npm-overlay/archive/main.tar.gz',
]
nixpkgsArchive = 'e05605ec414618eab4a7a6aea8b38f6fbbcc8f08'

[start]
cmd = 'npm run start'

[sebb3]

Maybe I should add that I have no clue what coolify is, but I assume your build is failing inside the container when installing the package... Hope this solves your problem as well, all my searches led to "It is not possible without providing your own Dockerfile" which I found very disappointing given that the whole point of running with nixpacks was to avoid that :)

[alexanderfink]

@sebb3 Thank you for your message, seeing your response gave me the idea to just use a simple nixpacks config file. You can see my answer below.

[alexanderfink]

In order to access your private or restricted npm packages simply create a nixpacks.toml file in the root of your project that adds the required scopes and tokens to the .npmrc in the setup phase.

[phases.setup]
cmds = [
  "echo '@<your-scope>:registry=https://npm.pkg.github.com' > .npmrc",
  "echo '//npm.pkg.github.com/:_authToken=${NPM_AUTH_TOKEN}' >> .npmrc",
]

IMPORTANT
When you add the environment variables in Coolify it is required to set the flag Build Variable otherwise it will not be available in the setup phase!

Hope this helps someone 😃

[Jeto143]

In order to access your private or restricted npm packages simply create a nixpacks.toml file in the root of your project that adds the required scopes and tokens to the .npmrc in the setup phase.

[phases.setup]
cmds = [
  "echo '@<your-scope>:registry=https://npm.pkg.github.com' > .npmrc",
  "echo '//npm.pkg.github.com/:_authToken=${NPM_AUTH_TOKEN}' >> .npmrc",
]

IMPORTANT When you add the environment variables in Coolify it is required to set the flag Build Variable otherwise it will not be available in the setup phase!

Hope this helps someone 😃

I believe double quotes might be needed for the second echo statement, as otherwise the generated echo wouldn't interpolate the environment variable correctly:

"echo \"//npm.pkg.github.com/:_authToken=${NPM_AUTH_TOKEN\" >> .npmrc",