Hex

The proxy passes the public Hex repository protocol through to repo.hex.pm, so Elixir and Erlang projects can apply the same package policy at install time.

Endpoint: <proxy-url>/hex

Authentication: the API key, sent as the password in HTTP basic auth. The username is not checked; _ is the conventional placeholder.

Hex repository metadata, signatures, and package archives pass through unchanged. ShieldedStack does not mutate package metadata or package contents. Allowed requests continue to the public Hex service; requests that fail policy are stopped by the proxy.

Mix

Point Mix’s existing hexpm repository at the proxy. Use an isolated HEX_HOME so this configuration does not change a developer’s normal Hex setup, and put the API key in a hostname-only NETRC entry:

export HEX_HOME="$(mktemp -d)"
export NETRC="$HEX_HOME/.netrc"
cat > "$NETRC" <<EOF
machine <proxy-host> login _ password $SHIELDEDSTACK_API_KEY
EOF
chmod 600 "$NETRC"

mix hex.repo set hexpm --url <proxy-url>/hex

<proxy-host> is the hostname only, without the scheme, path, or port. Keep the API key in the NETRC file or CI secret store, never in mix.exs.

This keeps standard Hex dependencies on the hexpm repository while routing them through the proxy. Because the proxy preserves the signed registry metadata unchanged, Hex continues to validate the registry origin normally. Do not disable registry-origin verification for this public Hex.pm setup.

Rebar3

Replace Rebar3’s existing hexpm repository URL with the ShieldedStack endpoint. Rebar3 expects the repository key to contain the complete HTTP Authorization value, so encode _ as the username and the ShieldedStack API key as the password:

export HEX_TRUSTED_MIRROR_URL="<proxy-url>/hex"
export HEX_REPOS_KEY="Basic $(printf '_:%s' "$SHIELDEDSTACK_API_KEY" | base64 | tr -d '\n')"

rebar3 compile

HEX_TRUSTED_MIRROR_URL changes the URL of the existing hexpm repository instead of adding a second repository, so packages cannot fall back to repo.hex.pm. Do not use HEX_MIRROR_URL for an authenticated proxy: Rebar3 treats it as untrusted and does not send repository credentials.

Keep HEX_REPOS_KEY in a local environment or CI secret store, not in rebar.config.

Lockfiles and dependency sources

The package scanner recognizes Hex package entries in mix.lock and rebar.lock, including direct and transitive dependencies. Commit lockfiles generated with the ShieldedStack repository configured so the project records the intended registry source.

Git and path dependencies are not Hex registry downloads. They are not supported by the Hex proxy or the Hex lockfile scanner, and must be reviewed and controlled separately.

Verify

Run your normal dependency command:

mix deps.get
# or
rebar3 compile

Resolved Hex packages appear under Packages in the Control Plane, attributed to the project name on the API key.

Troubleshooting

A package is absent from the inventory. Check whether it came from the public Hex repository, a Git URL, or a local path rather than the ShieldedStack repository.

401 or 403. Confirm the repository uses the current API key and that the client can reach the proxy over HTTPS.

A lockfile still points at another source. Regenerate the lockfile after configuring the ShieldedStack repository, then review and commit the resulting change.