Deployments

The firewall only protects installs that go through it. There are two ways to get them there.

Approach	What changes	Best for	Page
Configure the registry	Each package manager points at `sfw.example.com`	Developer laptops, CI runners, a first POC	Dev, CI/CD
DNS override	`registry.npmjs.org`, `pypi.org` and similar resolve to the firewall	Fleets where you can't touch every tool's config	DNS override

Which one?

Start with registry config. It is one command per ecosystem and is easy to undo.
Move to DNS override when you want coverage without per-tool config, typically pushed by MDM or set in corporate DNS. Every existing npm install and pip install command keeps working unchanged.
Either way, clients must trust the firewall's certificate. Use a certificate from your internal CA, or distribute the self-signed one.

Already using Artifactory or Nexus?

Point the artifact manager's remote repositories at the firewall instead of at the public registries. Developers keep using the artifact manager and change nothing. See the Artifactory and Nexus guides.

🚧
Block messages behind an artifact manager
Artifactory and Nexus replace the firewall's 403 with their own error. Installs still fail, but developers won't see Socket's reason or request ID.