Download Rules Configuration
This page covers self-hosted configuration. To evaluate the feature, build a policy, or see supported rule JSON, start with the Download Rules feature guide.
Download rules require a RepoFlow self-hosted plan that includes the feature. They work with local and remote repositories; virtual repositories are not supported.
Configuration
| Environment variable | Default | Purpose |
|---|---|---|
DOWNLOAD_RULES_MAX_RULES_PER_REPOSITORY | 10 | Limits the number of download rules in each repository. |
DOWNLOAD_RULES_CACHE_TTL_IN_SECONDS | 2 | Caches rule availability to reduce repeated lookups during high-volume downloads. Set to 0 to disable the cache. |
See Server Environment Variables for the authoritative variable reference.
Recommended rollout
- Create a disabled rule and verify its target and readable summary.
- Enable it in a non-production repository first.
- Test both package-client metadata requests and artifact downloads.
- Review the rule’s enforcement count before applying the same policy broadly.
When a rule depends on vulnerability data, also review Vulnerability Scanning Configuration, including scan scheduling and resource usage.