diff --git a/lib/config.js b/lib/config.js
index 344d202db..c4e6cb501 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -103,15 +103,19 @@ function allow_action(package, who, action) {
 }
 
 Config.prototype.allow_access = function(package, user) {
-	return allow_action.call(this, package, user, 'access');
+	return allow_action.call(this, package, user, 'allow_access') || allow_action.call(this, package, user, 'access');
 }
 
 Config.prototype.allow_publish = function(package, user) {
-	return allow_action.call(this, package, user, 'publish');
+	return allow_action.call(this, package, user, 'allow_publish') || allow_action.call(this, package, user, 'publish');
 }
 
-Config.prototype.allow_proxy = function(package, uplink) {
-	return allow_action.call(this, package, uplink, 'proxy');
+Config.prototype.proxy_access = function(package, uplink) {
+	return allow_action.call(this, package, uplink, 'proxy_access') || allow_action.call(this, package, uplink, 'proxy');
+}
+
+Config.prototype.proxy_access = function(package, uplink) {
+	return allow_action.call(this, package, uplink, 'proxy_publish');
 }
 
 Config.prototype.authenticate = function(user, password) {
diff --git a/lib/config_def.yaml b/lib/config_def.yaml
index 76430704b..57b0c89c3 100644
--- a/lib/config_def.yaml
+++ b/lib/config_def.yaml
@@ -1,18 +1,28 @@
 # path to a directory with all packages
 storage: ./storage
 
+# a list of users
 users:
   admin:
     # crypto.createHash('sha1').update(pass).digest('hex')
     password: __PASSWORD__
 
+# a list of other known repositories we can talk to
 uplinks:
   npmjs:
     url: https://registry.npmjs.org/
 
 packages:
   '*':
-    publish: admin
-    access: all
-    proxy: npmjs
+    # allow all users to read packages ('all' is a keyword)
+    # this includes non-authenticated (anonymous) users
+    allow_access: all
 
+    # allow 'admin' to publish packages
+    allow_publish: admin
+
+    # if package is not available locally, proxy requests to 'npmjs' registry
+    proxy_access: npmjs
+
+    # when package is published locally, also push it to remote registry
+    #proxy_publish: none