Varnish Orca
← Tutorials

Configure Composer to use Varnish Orca as the PHP package source

This tutorial describes 4 different ways to configure your Composer client to fetch PHP packages from a Varnish Orca virtual registry, instead of directly accessing the standard Packagist repository hosted on repo.packagist.org.

To accelerate, control and secure access to your Composer package registries with Varnish Orca, you need to configure override the repositories configuration.

There are 4 ways to configure the custom repository:

  1. Directly in the composer.json file for that project.
  2. Using the composer repo commands for that project.
  3. Modifying your global Composer config.json file for system-wide support for Orca.
  4. Adding the --global flag to the composer repo commands for system-wide support for Orca.

Prerequisites

Before following the instructions in this tutorial, there are a couple of prerequisites:

Here’s an example configuration for Orca that creates a virtual registry configuration named composer that proxies Composer requests to https://repo.packagist.org:

virtual_registry:
  registries:
  - name: composer
    remotes:
    - url: https://repo.packagist.org

This configuration allows the composer virtual registry to be matched by any hostname that has a subdomain containing composer. For example: composer.example.com.

Option 1: Configure a custom repository in composer.json

To connect your composer binary to the Varnish Virtual Registry on a per-project basis, modify the composer.json and add the required repository entries:

{
    "repositories": [
        {
        "packagist.org": false
        },
        {
        "type": "composer",
        "url": "https://composer.example.com"
        }
    ]
}

These repositories entries disable direct access to https://repo.packagist.org, and fetch PHP packages from https://composer.example.com instead.

The repositories section of the composer.json schema describes this in detail.

If your repository is a plain-HTTP repository without TLS support, add secure-http: false to the config block:

{
    "repositories": [
        {
        "packagist.org": false
        },
        {
        "type": "composer",
        "url": "http://composer.example.com"
        }
    ],
    "config": {
        "secure-http": false
    }
}

You can now add dependencies and run composer install to fetch those dependencies from the Varnish Virtual Registry.

Option 2: use composer repo commands

Instead of directly modifying your composer.json file, you can use the composer repo commands to add a custom repository and to disable Packagist as the standard repository.

Run the following commands to fetch Composer packages from https://composer.example.com:

composer repo add orca composer https://composer.example.com
composer repo disable packagist.org

If your repository is a plain-HTTP repository without TLS support, run the following command:

composer config secure-http false

Option 3: modify global config.json file

The previous options set a custom repository on a per-project basis. If you want to use the Varnish Virtual Registry system-wide, you can add the same repository configuration to your global config.json file that lives in your Composer home directory.

The standard location of the config.json is ~/.composer, but you can run composer config home to figure out the location of the Composer home directory on your system.

Add the following configuration to config.json to override the standard repository on a system-wide basis and disable Packagist as the standard repository:

{
    "repositories": [
        {
        "packagist.org": false
        },
        {
        "type": "composer",
        "url": "https://composer.example.com"
        }
    ]
}

If your repository is a plain-HTTP repository without TLS support, add secure-http: false to the config block:

{
    "repositories": [
        {
        "packagist.org": false
        },
        {
        "type": "composer",
        "url": "http://composer.example.com"
        }
    ],
    "config": {
        "secure-http": false
    }
}

Every composer install command on your system will now route package requests through composer.example.com.

Option 4: use composer repo commands with –global flag

Those same composer repo commands can be used to register a custom Composer registry on a system-wide basis. Just add the --global flag to your command to register the Virtual Registry at a global level.

Run the following commands to fetch Composer packages from https://composer.example.com system-wide:

composer repo add --global orca composer https://composer.example.com
composer repo disable --global packagist.org

If your repository is a plain-HTTP repository without TLS support, run the following command to allow plain HTTP requests on a global level:

composer config --global secure-http false