How to Host Private Laravel Packages in Minutes (Without Satis)

If you run a Laravel agency or manage a microservice architecture, you eventually hit the "shared code" problem. You have custom internal tools, bespoke Nova components, or core API wrappers that you need to share across multiple client projects, but you can't publish them publicly to Packagist.

For years, the default open-source answer has been Satis. But Satis comes with friction: you have to manually edit a satis.json file every time you add a repo, set up cron jobs to rebuild the static site, and manage complex SSH keys.

Today, we are going to look at a modern, zero-config alternative: spinning up a private, self-hosted package registry using a single Rust binary called Cargoman.

Here is how to get a private Composer registry running and connected to your Laravel project in minutes.

The Goal

1. Spin up a lightweight, self-hosted registry via Docker.
2. Sync a private GitHub repository automatically.
3. Install the private package into a new Laravel app securely.

Step 1: Spin up the Registry

Because Cargoman is written in Rust, it doesn't require a heavy stack of PHP workers, Redis, or Supervisor. It ships as a single, compiled Docker container.

Create a docker-compose.yml file on your server:

services:
  cargoman:
    image: ghcr.io/byte8io/cargoman:latest
    ports:
      - "8080:8080"
    environment:
      - DATABASE_URL=postgres://user:pass@db:5432/cargoman
      - ADMIN_TOKEN=your_super_secret_bootstrap_token

  db:
    image: postgres:18-alpine
    environment:
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=pass
      - POSTGRES_DB=cargoman

Run docker-compose up -d. That's it. Your registry is live at http://localhost:8080 with an embedded admin dashboard.

Step 2: Sync Your Private Git Repositories

Instead of manually typing out Git URLs and configuring SSH keys like in Satis, we are going to use a Personal Access Token (PAT).

1. Log into your new Cargoman dashboard.
2. Go to Integrations > GitHub and paste a fine-grained PAT (with read access to your code).
3. Cargoman instantly discovers your repositories.

Select the private Laravel package you want to host. Cargoman will automatically register the webhooks so that every time you git push a new release tag (like v1.2.0), the registry updates instantly. No cron jobs required.

Step 3: Install the Package in Laravel

The biggest headache with private packages is littering your Laravel composer.json with a dozen different Git repository URLs.

Cargoman uses a single-URL architecture. You only add the registry once.

In your Laravel project's composer.json, add your new private registry:

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://packages.mycompany.com"
    }
  ]
}

Next, we need to authenticate. Never put tokens in your composer.json (they will get committed to Git!). Instead, use Composer's global auth.json file.

Run this command in your terminal to store your access token securely:

composer config --global http-basic.packages.mycompany.com token your_cargoman_access_token

Now, just require your package like normal:

composer require my-agency/core-billing

Composer will hit your Cargoman registry, authenticate seamlessly, and download your proprietary code.

Going Further with Cargoman Cloud

The self-hosted setup above works great, but if you don't want to manage Docker containers, databases, or server updates, Cargoman also offers a fully managed cloud platform that takes things further.

Here is what changes when you go cloud:

• GitHub App instead of PATs. Instead of generating and rotating Personal Access Tokens, you install the Cargoman GitHub App with a single click. It handles repository discovery, permissions, and webhook registration automatically. No tokens to leak or expire.
• Richer admin dashboard. The cloud UI includes team management, download analytics, vulnerability scanning results, and customer access controls — features that aren't available in the self-hosted admin panel.
• Your own subdomain. Each cloud account gets a dedicated registry URL (like acme.packages.cargoman.io) with TLS included. No reverse proxy setup or certificate management on your end.
• Zero ops. Backups, updates, scaling, and monitoring are handled for you. Your registry is always on the latest version.

The self-hosted edition is perfect for teams that want full control over their infrastructure. But if you would rather spend your time shipping Laravel code instead of maintaining a registry server, the cloud option lets you skip straight to Step 2.

You can start a 14-day free trial at cargoman.io.

The Wrap Up

You now have a blazing-fast, memory-safe package registry that syncs automatically with your Git workflow. No manual JSON editing, no static rebuilds, and a perfectly clean composer.json in your Laravel apps — whether you self-host or go fully managed.