# Repositories and access

> Make repositories, proxies and groups, give people Publish, add CI pipelines and limit the networks a repository takes requests from.

Source: https://docs.telesphorepo.com/repositories-and-access/

## Make a repository

1. Open **Settings** › **Repositories**, and click **New repository**.

2. Choose **A repository**.

3. Type a name, such as `releases`.

4. Choose the format.

5. Under **Who can download**, choose **Private** or **Public**.

6. Click **Create repository**.

The **Use this repository** tab of the new repository shows the setup for its clients. All addresses are in [Repository addresses](/commands-and-settings/#repository-addresses).

## Add public packages

A **proxy** keeps a copy of each package that people download from a public registry.

A **group** puts several repositories behind one address. Put your repository and a proxy in a group, and people get both through one address.

1. Click **New repository**, and choose **A proxy of a remote repository**.

2. Type a name, pick the format, and click a well-known remote, such as **Maven Central** or **npm registry**.

3. Click **Create proxy**.

4. Click **New repository** again, and choose **A group of repositories**.

5. Type a name, pick the same format, and tick your repository and the proxy. Your own repositories come first.

6. Click **Create group**.

A group reads its members in order. In an npm, Python, Cargo or NuGet group, the first member that has a package name owns that name. So a public package cannot take the place of your private one.

## Make a Docker repository

Make it as above, and choose **Docker** as the format. It holds container images, Helm charts and other OCI files.

The name, such as `docker`, is the first part of every image name.

Docker needs the server at the root of a host, such as `https://repo.example.com`. For big images, see [Push large images](/push-large-images/).

## Give people Publish

1. Open **Settings** › **Repositories** › your repository › **Access**.

2. Under **People**, click **Give access**.

3. Tick the people.

4. Tick **Publish**.

5. Click **Give 1 person access**.

To add a person first, see [People and sign-in](/people-and-sign-in/).

Then send them [Install the CLI](/install-cli/) and [Publish from a project](/publish-from-a-project/). For downloads, send [Use packages in your builds](/use-packages/).

## Add a CI pipeline

A CI pipeline lets the jobs of one GitHub repository or one Jenkins publish, with no stored secret. A developer sends you the values. [Publish from CI](/publish-from-ci/#ask-for-a-ci-pipeline) tells them which ones.

1. Open **Settings** › **CI pipelines**, and click **New CI pipeline**.

2. Choose **GitHub Actions** or **Jenkins**.

3. Fill in the values from the developer.

4. Tick the repository.

5. Click **Create CI pipeline**.

### Jenkins: a freestyle job or a Jenkinsfile

Both kinds of job use the same CI pipeline.

Under **Jobs**, write each full job name with its folders, such as `team/app`. A branch of a multibranch pipeline is its own job, such as `app/main`.

## Limit where requests come from

A repository can take downloads or publishes from some networks only. With no rule, any network works.

1. Open **Settings** › **Repositories** › your repository › **Access**.

2. Under **Download** or **Publish**, find **From where**.

3. Click **Add network list** to pick a list, such as **GitHub Actions**. Or click **Add addresses** to paste addresses.

4. Click **Save**, then **Save access**.

The rules hold for everyone, admins too.

### Network lists

Open **Settings** › **Networks**.

- **Downloaded lists**: Cloudflare and GitHub Actions. The server refreshes them every day.
- **Your lists**: click **New network list**, and paste addresses in any layout.

A change to a list applies to every repository that uses it.

## If something goes wrong

A proxy cannot reach its remote

Check the address. To create the proxy anyway, click **Create anyway**.

Jenkins jobs cannot publish, and the server cannot reach Jenkins

Open the Jenkins address followed by `/oidc/jwks`. Paste the whole page into **Jenkins keys** on the CI pipeline. Do it again when Jenkins changes its keys.

A request gets 403: your address is not allowed

The address is outside the **From where** rules of the repository. **Activity** shows the address.

If every visitor seems to have the address of your proxy, the server does not trust that proxy yet. See [Trust the proxy](/run-the-server/#trust-the-proxy).