TürkçeDemo
Menu

Procedure

Configure upstream access safely and verify ordered resolution

Test proxy caching, TLS and redirect controls, negative caching, and group-member order with a real package request.

Content statusVerified in sourceDocumentation versionLatest
Smart Kubaba repository inventory and proxy or group management actions
Repository type, format, storage assignment, and active state are checked here before proxy or group validation.

Role and prerequisites

Proxy settings require ConfigureProxy, group order requires ConfigureGroup, and the package test requires Download on the target repository.

  • The proxy repository and upstream must use the same package format; an authenticated upstream must use HTTPS.
  • A Group requires at least one non-Group candidate in the same organization and format.
  • If the test package exists at the same coordinate in Hosted and Proxy members, record the first-match-wins result explicitly.

Procedure steps

  1. In Proxy Settings, enter upstream URL, cache TTL, negative-cache TTL, timeout, and retry values; select an authentication type published by the backend for the format.
  2. Enter the secret only in the masked field, save, and run Test Connection. Inspect TLS state, HTTP result, and the sanitized redirect chain.
  3. Request a package version not yet present in the proxy using a real client; verify the first request is served upstream and the repeated request from cache.
  4. In Group Members, add eligible Hosted and Proxy members, order them by resolution priority, and persist the full order atomically with Save Order.
  5. Request the same package through the Group URL; confirm the first active matching member is used and inactive members are skipped.

Success criteria

  • The connection test reports reachability, TLS state, duration, and redirect evidence without secrets.
  • Package Usage distinguishes Proxy Remote, Proxy Cache, or the Group member as the served source; upstream hops appear in Outbound Logs.
  • A GROUP_MEMBERS_UPDATED audit record exists and the saved member order is preserved on reload.

Failure and security boundaries

  • Credentials never appear in API responses, logs, redirect summaries, or persistent browser storage; a blank secret retains the existing value only for an unchanged type.
  • SSRF controls reject private, loopback, link-local, and metadata-service targets; credentials are not forwarded across authorities.
  • Nested Groups, format mismatches, duplicates, and self-membership are rejected with 422.
  • When proxying is disabled, only existing cache is served and no upstream request occurs. An inactive repository behaves as missing.