packagist-mirror / Composer pull-through cache

This host proxies and caches packages from packagist.org. Point Composer here to speed up composer install/composer require and cut outbound rate-limit hits. Replace mirror.example.com below with this server's actual hostname.

01 — GLOBAL COMPOSER CONFIG

Set it once for your user

Register the mirror as the packagist.org repository for your user. This writes to COMPOSER_HOME/config.json (usually ~/.composer/config.json).

shell

composer config -g repos.packagist composer https://mirror.example.com

# confirm it took
composer config -g -l | grep repo

02 — PER-PROJECT (RECOMMENDED)

composer.json repositories block

Scope the mirror to a single project and commit it, so every teammate and CI job resolves through the mirror automatically.

composer.json

{
  "repositories": [
    { "type": "composer", "url": "https://mirror.example.com" },
    { "packagist.org": false }
  ]
}

The second entry disables the default packagist.org repo so lookups only go through the mirror. Drop it if you want the mirror tried first with public Packagist as fallback.

03 — PRIVATE / INTERNAL PACKAGES

auth.json for token-based access

auth.json

{
  "bearer": {
    "mirror.example.com": "YOUR_TOKEN"
  }
}

shell

composer config -g http-basic.mirror.example.com username token

Never commit auth.json — keep it local or inject it as a CI secret.

04 — CI/CD

Set the repo in the pipeline

No repo changes needed — configure it as a pipeline step before composer install, or inject COMPOSER_AUTH as JSON for tokens.

shell

composer config -g repos.packagist composer https://mirror.example.com
export COMPOSER_AUTH='{"bearer":{"mirror.example.com":"YOUR_TOKEN"}}'
composer install --no-interaction --prefer-dist

05 — VERIFY

Confirm installs are going through the mirror

shell

composer config -g -l | grep repo
curl -s https://mirror.example.com/packages.json -o /dev/null -w "%{http_code}\n"

# install something and time it
time composer require monolog/monolog --dry-run

Check	Expected result
`composer config -g -l`	Lists `mirror.example.com` as the packagist repo
`GET /packages.json`	`200` — mirror is reachable
First install of a package	Slower — cache miss, fetched from upstream and stored
Repeat install	Fast — served from local cache

06 — NOTES

Pull-through, not a full copy. This mirror caches package metadata and dist archives as they're requested — it doesn't proactively sync the entire Packagist catalog. The first install of any given package/version is still fetched from packagist.org.

Packages aren't "published" through this mirror — new versions on Packagist come from tagged releases in the package's own VCS repo via webhook, same as always. This mirror only accelerates composer install/require reads. If it's served over plain HTTP internally, add it under secure-http: false only on trusted internal networks, or terminate TLS in front of it.