Managing

Managing Upstreams

Add, edit, and delete upstream registries in Drevnix. Supported registry types and credential management.

Using an AI assistant? Give it this file.

/llms.md is a single Markdown file covering installation, configuration, quickstart, clients, upstreams, permissions, TLS, and production deployment. Copy it and paste it into your AI chat, or tell the AI to fetch https://drevnix.tech/llms.md.

Managing Upstreams

An upstream is a Docker registry that Drevnix proxies requests to. You configure each upstream once with its URL and credentials. Clients never see or need those credentials.

Upstream credentials are encrypted at rest using AES256-GCM and are never returned by the API after creation.

Supported registry types

Drevnix supports any Docker Registry V2-compatible registry:

Registry	URL
GitHub Container Registry	`https://ghcr.io`
Docker Hub	`https://registry-1.docker.io`
Amazon ECR	`https://<account>.dkr.ecr.<region>.amazonaws.com`
Google Artifact Registry	`https://<region>-docker.pkg.dev`
Azure Container Registry	`https://<name>.azurecr.io`
Private Harbor / Nexus	`https://your-registry.internal`

Public registries that require no authentication can be added without credentials.

Creating an upstream

Via portal: Upstreams → Add Upstream

Via API:

curl -X POST http://drevnix.company.com:8002/v1/upstreams \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{
    "id": "ghcr",
    "address": "https://ghcr.io",
    "username": "your-github-username",
    "password": "ghp_yourPAThere"
  }'

Field	Description
`id`	Short unique slug used in pull URLs (e.g. `ghcr`, `dockerhub`, `ecr-prod`). Cannot be changed after creation.
`address`	Full registry URL including scheme.
`username`	Upstream credential username. Optional for public registries.
`password`	Upstream credential password. Encrypted at rest, never returned by the API.

Listing upstreams

curl http://drevnix.company.com:8002/v1/upstreams \
  -u admin:password

Passwords are never included in the response.

Rotating credentials

Update the upstream with new credentials. No clients need to be updated. They authenticate against Drevnix, not the upstream registry:

curl -X PUT http://drevnix.company.com:8002/v1/upstreams/ghcr \
  -u admin:password \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your-github-username",
    "password": "ghp_newPAThere"
  }'

Deleting an upstream

curl -X DELETE http://drevnix.company.com:8002/v1/upstreams/ghcr \
  -u admin:password

Deleting an upstream with active clients will result in those clients receiving 404 when they try to pull. Remove or update related permissions after deletion.

Amazon ECR notes

ECR credentials expire every 12 hours. You must refresh the stored password periodically using a cron job or Lambda that calls the Drevnix API with a fresh ECR token:

# Get a fresh ECR token
TOKEN=$(aws ecr get-login-password --region us-east-1)

# Update the upstream credential
curl -X PUT http://drevnix.company.com:8002/v1/upstreams/ecr-prod \
  -u admin:$DREVNIX_ADMIN_PASSWORD \
  -H "Content-Type: application/json" \
  -d "{\"username\": \"AWS\", \"password\": \"$TOKEN\"}"

Run this every 6–10 hours to ensure the token is always fresh.