Quick Start Tutorial

This tutorial goes from a fresh Drevnix install to a working docker pull through the proxy. It assumes you have completed Initial Setup and have a super-admin account.

What we’ll do

1. Add ghcr.io as an upstream
2. Create a client for a CI pipeline
3. Grant the client access to a specific repository pattern
4. Log Docker into the proxy and pull an image
5. Verify the pull in the audit log

---

Step 1: Add the upstream

In the portal (Upstreams → Add Upstream):

Field	Value
ID	ghcr
URL	https://ghcr.io
Username	Your GitHub username
Password	A GitHub PAT with read:packages scope

Click Save. The credentials are encrypted at rest immediately.

Step 2: Create a client

In the portal (Clients → Add Client):

Field	Value
Client ID	ci-pipeline
Password	Click Generate and copy the result (shown only once)

Optionally set an expiration date if you want this client to stop working automatically.

Click Save. The password is hashed with bcrypt and never stored in plaintext.

Step 3: Add a permission

On the client’s detail page, click Add Permission:

Field	Value
Pattern	ghcr/myorg/myapp

This grants ci-pipeline access to exactly myorg/myapp on the ghcr upstream. Nothing else.

For broader access use a wildcard:

Pattern	Grants access to
ghcr/myorg/myapp	Only that one repository
ghcr/myorg/*	All repositories under myorg on ghcr
ghcr/*	Everything on ghcr
*	Everything on all upstreams

Click Save.

Step 4: Configure Docker and pull

Log Docker into the Drevnix proxy using the client credentials:

echo "your-client-password" | docker login drevnix.company.com:8000 \
  --username ci-pipeline \
  --password-stdin

Pull an image through the proxy:

docker pull drevnix.company.com:8000/ghcr/myorg/myapp:latest

The URL structure is always:

<drevnix-host>:8000/<upstream-id>/<repository>:<tag>

Step 5: Check the audit log

In the portal, go to Audit Logs. You should see an entry for the pull showing the client ID, upstream, repository, tag, HTTP status, and timestamp.

---

Using with GitHub Actions

- name: Log in to Drevnix
  uses: docker/login-action@v3
  with:
    registry: drevnix.company.com:8000
    username: ${{ secrets.DREVNIX_CLIENT_ID }}
    password: ${{ secrets.DREVNIX_CLIENT_SECRET }}

- name: Pull image
  run: docker pull drevnix.company.com:8000/ghcr/myorg/myapp:latest

Store DREVNIX_CLIENT_ID and DREVNIX_CLIENT_SECRET as repository or organisation secrets. The upstream registry credentials never need to leave Drevnix.