Private PyPI Registry (CI/CD Setup)

Private PyPI Registry (DevPI) — Usage Guide

Registry URL: https://pypi.registry.hochguertel.work Auth: Authentik OIDC (browser) + Authentik API tokens (CLI) Container: registry-pypi

Architecture

• Browser login: Authentik OIDC — native DevPI plugin redirects to Authentik
• CLI/CI login: Authentik API token as password — plugin validates against Authentik API
• Indexes: root/pypi (public mirror) + root/dev (private uploads, bases: root/pypi)

Indexes

Index	Purpose	Upload
root/pypi	Public PyPI mirror	Read-only
root/dev	Private packages	:developers, :admins

CLI Usage

Installing packages

# From private index (includes both private + public)
pip install --index-url https://pypi.registry.hochguertel.work/root/dev/+simple/ <package>
uv pip install --index-url https://pypi.registry.hochguertel.work/root/dev/+simple/ <package>

Publishing packages

uv build
uv publish \
  --publish-url https://pypi.registry.hochguertel.work/root/dev/ \
  --username infra \
  --password <api-token>

twine

~/.pypirc

[hochguertel]
repository = https://pypi.registry.hochguertel.work/root/dev/
username = infra
password = <api-token>

twine upload --repository hochguertel dist/*

CI/CD (Forgejo Actions)

- name: Publish to DevPI
  run: |
    uv build
    uv publish \
      --publish-url "${{ secrets.DEVPI_URL }}/" \
      --username infra \
      --password "${{ secrets.DEVPI_TOKEN }}"

Key Differences from npm/Docker

Aspect	DevPI (PyPI)	Verdaccio (npm)	Docker Registry
Auth	Authentik API token (Basic)	htpasswd (Basic)	JWT (RS256) via auth-bridge
UI auth	Authentik OIDC (native)	Authentik OIDC	Authentik SSO forward-auth
ACL	Group-based	Scope-based	Group-based
Push tool	uv publish / twine	npm publish	podman push

Full guide

The complete guide with troubleshooting, token management, operations, and twine/devpi client setup is in the registries repo: /opt/services/registries/docs/pypi-registry-guide.md