Managing

Managing Clients

Create, update, and delete client identities. Set expiration dates for temporary access.

Using an AI assistant? Give it this file.

/llms.md is a single Markdown file covering installation, configuration, quickstart, clients, upstreams, permissions, TLS, and production deployment. Copy it and paste it into your AI chat, or tell the AI to fetch https://drevnix.tech/llms.md.

Managing Clients

A client is an identity that authenticates to the Drevnix proxy endpoint (:8000) using standard Docker HTTP Basic Auth. Clients are completely separate from upstream registry accounts. Revoking a client does not affect upstream credentials, and upstream credentials are never exposed to clients.

Client passwords are hashed with bcrypt immediately on creation and are never stored in plaintext. If a password is lost, delete the client and create a new one.

Creating a client

Via portal: Clients → Add Client

Via API:

curl -X POST http://drevnix.company.com:8002/v1/clients \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{
    "id": "ci-pipeline-prod",
    "password": "a-strong-random-password"
  }'

With an expiration date (ISO 8601):

curl -X POST http://drevnix.company.com:8002/v1/clients \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{
    "id": "contractor-alice",
    "password": "temp-password",
    "expiration_time": "2025-06-01T00:00:00Z"
  }'

Expiration dates

Clients with an expiration date automatically return 401 Unauthorized once the date passes. No manual cleanup needed. This makes them ideal for:

Contractor or third-party access
CI pipelines for ephemeral environments
Any access that should be time-boxed by policy

Expired clients can be seen in the portal and deleted or their expiry updated.

Recommended client patterns

Pattern	Example ID	Notes
One per CI pipeline	`ci-pipeline-prod`	Scope permissions to only the images that pipeline needs
One per developer	`dev-alice`	Revoke individually if needed
One per microservice	`svc-payments`	Pull only its own base image
Temporary contractor	`contractor-alice`	Always set an expiration date

Listing clients

curl http://drevnix.company.com:8002/v1/clients \
  -u admin:password

Supports limit and offset for pagination.

Updating a client

Update the expiration date:

curl -X PUT http://drevnix.company.com:8002/v1/clients/contractor-alice \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{"expiration_time": "2025-12-31T00:00:00Z"}'

Passwords cannot be updated. Delete and recreate the client to change a password.

Deleting a client

Access is revoked immediately:

curl -X DELETE http://drevnix.company.com:8002/v1/clients/contractor-alice \
  -u admin:password

Viewing a client’s permissions

curl "http://drevnix.company.com:8002/v1/permissions?client_id=ci-pipeline-prod" \
  -u admin:password