Gemstash

Search for Gemstash in the Azure Marketplace, select the SecureAnyCloud publisher and choose Create.

Add Network Security Group rules for TCP 22 (admin) and TCP 80 (the gem server) from your client networks.

RG="gemstash-prod"; LOCATION="eastus"; VM_NAME="gemstash-01" IMAGE_URN="sac1647283583153:gemstash:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name gemstash-vnet --address-prefix 10.100.0.0/16 --subnet-name gemstash-subnet --subnet-prefix 10.100.1.0/24 az network nsg create -g "$RG" --name gemstash-nsg az network nsg rule create -g "$RG" --nsg-name gemstash-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name gemstash-nsg --name allow-http --priority 110 \
  --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:gemstash:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name gemstash-vnet --subnet gemstash-subnet --nsg gemstash-nsg --public-ip-sku Standard

The per-instance push API key is generated on first boot and stored in a root-only file. Connect over SSH and read it:

ssh azureuser@<public-ip>
sudo cat /root/gemstash-credentials.txt

The file contains the mirror URL, the private repository URL and the per-instance API key, plus quick-start commands. Store the key somewhere safe. It is unique to this VM, and it authorizes pushing private gems.

Confirm that both services are active and that Gemstash is bound to loopback only. In the listener output, 127.0.0.1:9292 (Gemstash) is loopback-only, while nginx listens publicly on :80:

systemctl status gemstash nginx --no-pager gemstash version ss -tln | grep -E ':9292|:80 '

The /healthz endpoint is served by nginx without authentication, so you can use it for load balancer and Azure health probes. It returns HTTP 200:

curl -o /dev/null -w 'healthz: HTTP %{http_code}\n' http://127.0.0.1/healthz

Gemstash caches public gems from rubygems.org and serves them from the mirror at the root URL. Fetching public gems needs no authentication.

From the VM, confirm that pull-through works by fetching a public gem through Gemstash. It downloads from rubygems.org the first time and caches it for everyone after:

gem fetch --clear-sources --source http://127.0.0.1/ rake

On your developer machines or CI, point Bundler at the mirror so that every bundle install goes through Gemstash. Replace <public-ip> with your VM's public IP or DNS name:

bundle config mirror.https://rubygems.org http://<public-ip>

From then on, bundle install fetches public gems through your Gemstash server, cached and shared across the team.

Private gems are pushed to the /private path and require the per-instance API key. An unauthenticated push, or a push with the wrong key, is rejected with HTTP 401.

Expect these results: a push with no key returns 401, a push with a wrong key returns 401, a push with the per-instance key returns 200, and the private gem is then fetchable.

To push one of your own gems, add your per-instance API key to RubyGems credentials, then push to the /private host. Replace <public-ip> and <GEMSTASH_API_KEY> with your VM's IP and the key from Step 3:

mkdir -p ~/.gem && chmod 0700 ~/.gem echo -e "---\n:sac: <GEMSTASH_API_KEY>" >> ~/.gem/credentials chmod 0600 ~/.gem/credentials gem push --key sac --host http://<public-ip>/private my-gem-0.1.0.gem

To install a private gem from a Gemfile, wrap it in a source block that points at /private. Gemstash serves everything else from the mirror:

source "http://<public-ip>" gem "rake" source "http://<public-ip>/private" do gem "my-gem" end

The Gemstash configuration at /etc/gemstash/config.yml binds the server to loopback only, stores its data under /var/lib/gemstash with the SQLite adapter, and points the mirror upstream at rubygems.org. The per-instance API key lives in the root-only credentials file, and gemstash authorize --list shows exactly one key on a fresh VM:

grep -E ':bind|:base_path|:db_adapter|:rubygems_url|:protected_fetch' /etc/gemstash/config.yml
sudo stat -c '%n %a %U:%G' /root/gemstash-credentials.txt

Gemstash is served over plain HTTP on port 80 for convenience. For production, front it with your own DNS name and a CA-signed certificate:

• Point a DNS record (for example gems.example.com) at the VM public IP.
• Add a TLS server block to nginx (for example with a Let's Encrypt certificate via certbot, or your internal CA), proxying to http://127.0.0.1:9292. Then run sudo nginx -t && sudo systemctl reload nginx.
• Have clients use https://gems.example.com for both the mirror and /private.

Protected fetching. By default, private gems can be fetched without a key. To require an API key with the fetch permission for private gem downloads too, run sudo gemstash setup, enable protected fetching, then restart Gemstash. Clients pass the key as the HTTP Basic auth username on the /private source.

PostgreSQL for durability. For larger or highly durable deployments, switch the store from SQLite to an on-box PostgreSQL by setting :db_adapter: postgres and the connection options in /etc/gemstash/config.yml, then restart Gemstash. SQLite is the self-contained default and needs no database password.

• Gemstash: 2.8.2 (MIT), by the RubyGems and Bundler team
• Ruby: Ubuntu 24.04 archive Ruby 3.2 (security supported)
• Server binding: 127.0.0.1:9292 (loopback only)
• Front proxy: nginx (:80), client_max_body_size 0, /healthz returns 200
• Store: SQLite adapter, base path /var/lib/gemstash (gem cache, private gems and database)
• Credential: per-instance push API key, generated on first boot, in /root/gemstash-credentials.txt (0600)
• Operating system: Ubuntu 24.04 LTS (patched at build time)
• License: MIT (Gemstash)

sudo systemctl status gemstash
sudo systemctl restart gemstash
sudo journalctl -u gemstash -f sudo systemctl reload nginx

The gem cache, private gems and SQLite database live under /var/lib/gemstash and persist across service restarts and VM reboots.

To create more API keys or scope permissions, run sudo gemstash authorize push yank --config-file /etc/gemstash/config.yml. To rotate or remove a key, use sudo gemstash authorize --remove --key <key> --config-file /etc/gemstash/config.yml.

• Restrict the NSG. Allow TCP 80 (and 22 for admin) only from the client networks that need the mirror and the private repository. Do not expose Gemstash to the public internet unless you intend to.
• Front with TLS (Step 9) for production, so gem traffic and API keys are encrypted in transit.
• Enable protected fetching (Step 10) if your private gems must not be downloadable without a key.
• Rotate the API key. If the per-instance key is ever exposed, remove it and authorize a new one with gemstash authorize.
• Keep the OS patched. Unattended security upgrades remain enabled on the running VM.
• Back up /var/lib/gemstash to preserve your private gems and cache.

Gemstash is free, open-source software built by the RubyGems and Bundler team and distributed under the MIT License. This SecureAnyCloud image bundles the unmodified upstream gem. SecureAnyCloud provides the packaging, hardening, per-instance API key automation and 24/7 support with a guaranteed 24-hour response SLA.

This image is not affiliated with, endorsed by or sponsored by the RubyGems project. The Gemstash name is used only to identify the software shipped in this image.

Deploy on Azure

Find Gemstash on Ubuntu 24.04 on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Azure portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch Gemstash 2.8 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com