Freedom251 › Artifact repository software
Gemstash
What Gemstash is
Gemstash is a free, open-source, self-hosted cache for remote Ruby gem servers and private gems. It can fetch from multiple upstream sources, use a configurable default, and act as a Bundler mirror; the simpler mirror setup requires Bundler 1.11.0 or later. Teams can push, fetch, and yank private gems through the RubyGems command line with API keys and specific permissions. Private gems and specifications are open without authentication by default, although protected fetching can be enabled. Gem files remain cached indefinitely, while dependency metadata lasts 30 minutes by default. Files go under ~/.gemstash, with SQLite, PostgreSQL, MySQL, and MySQL2 adapters. Memcached can replace the in-memory cache. Puma and Rack power the server, whose configuration is limited, and a /health endpoint reports system status.
Who it suits
It suits teams using Bundler across machines, publishing private gems, or repeatedly retrieving the same dependencies.
What it does well
- Free and open source under MIT License
- Supports multiple upstream gem sources
- Fine-grained API-key permissions
- Several database adapters available
- Health endpoint reports service status
What to know first
- Private access is unauthenticated by default
- Simpler mirror setup needs Bundler 1.11.0+
- Server configuration is not customizable
- Self-hosted deployment required
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Gemstash | Open-source Ruby gem; self-hosted | Free |
As github.com lists them, read 5 Oct 2026. The maker's own page has the final word.
Verdict
Gemstash combines upstream proxying, indefinite gem caching, private-gem hosting, and configurable storage for Ruby workflows. Teams should address its default unauthenticated access and limited server configuration during setup.
Facts from Gemstash's own pages
- Access controls
- Gemstash API keys can be given specific permissions for pushing, yanking, and fetching gems. · github.com, 5 Oct 2026
- Authentication caveat
- Private gems and specs are accessible without authentication by default; protected fetching can be enabled in setup. · github.com, 5 Oct 2026
- Bundler integration
- Bundler can be configured to mirror gem sources through Gemstash, with the simpler mirror setup requiring Bundler 1.11.0 or later. · github.com, 5 Oct 2026
- Caching
- Gem files are cached indefinitely, while dependency metadata is cached for 30 minutes by default. · github.com, 5 Oct 2026
- Caching backend
- The default in-memory cache can be replaced with a Memcached server or cluster. · github.com, 5 Oct 2026
- Intended users
- The project suggests Gemstash for teams using Bundler across machines, publishing private gems, or repeatedly bundling the same gems. · github.com, 5 Oct 2026
- License
- The project is available under the MIT License. · github.com, 5 Oct 2026
- Maintainer
- Gemstash is maintained by Ruby Central, which describes itself as a nonprofit supporting Ruby infrastructure. · github.com, 5 Oct 2026
- Monitoring
- Gemstash provides a /health endpoint that reports status for its heartbeat, storage, and database. · github.com, 5 Oct 2026
- Private gems
- Users can push, fetch, and yank private gems using API keys and the RubyGems command line. · github.com, 5 Oct 2026
- Purpose
- Gemstash is a cache for remote gem servers such as RubyGems.org and a private gem source. · github.com, 5 Oct 2026
- Server limitation
- Gemstash uses Puma and Rack, and its server configuration is not customizable, although the bind address and Puma thread count can be configured. · github.com, 5 Oct 2026
- Storage and database
- Gemstash stores files under ~/.gemstash by default, and supports SQLite, PostgreSQL, MySQL, and MySQL2 database adapters. · github.com, 5 Oct 2026
- Upstream sources
- Gemstash can fetch from multiple gem sources, and its default source can be changed in its configuration. · github.com, 5 Oct 2026
Where Gemstash stands on Freedom251
- Artifact repository software#36 of 64