apt

/apt/<proxy-name>

Ubuntu and Debian packages, with the signatures intact

Point your client at it

bash

deb http://HOST:10220/apt/ubuntu jammy main

Replace HOST with your mirror’s address. Port 10220 is the server’s default.

Upstream: https://archive.ubuntu.com/ubuntu
What is stored: Packages in the blob store; dists/** metadata in the blob store but uncatalogued by design.

How it works

Verified, and for apt that means a CHAIN rather than a per-package signature: gpgv checks InRelease (or Release plus Release.gpg) against a keyring you configure, the Release covers each index by SHA256, and each index covers every .deb in it. A package whose bytes disagree is refused before it is stored. Without a keyring the hashes are still checked, which is integrity without authenticity — /backends reports which of the two you have.
apt is the strictest ecosystem here, and that one constraint shapes the whole backend: repo metadata has to come back BYTE-EXACT. apt checks Release, InRelease, and Packages.gz against signatures it already trusts, so a mirror that rewrites a single byte of them breaks the signature and every client refuses the repo outright. Rewriting URLs, the trick most of the other backends use, is simply not available here.
Indexes under dists/** are revalidated against upstream and also kept in the blob store. That second part is deliberate and is the whole point: it is what lets apt update still resolve when upstream is unreachable. They are never catalogued.
A .deb never changes once published, so a package is stored on first fetch and served from cache after that without asking upstream again.
The path segment after /apt/ is the name YOU gave the proxy in your config — ubuntu in the shipped example — not the distro or the suite. One proxy is one ARCHIVE and serves every suite it carries, so the release lives in the suite (jammy above), never in the name.

Things that have cost real time

Written down because they were paid for once already.

A proxy's suites list looks like a constraint and is really a SCOPE: it is what prefetch primes and what GC reasons about, while the backend proxies any path on demand. So a proxy declaring three jammy suites is a working 24.04 archive — until you go offline, when apt update against noble fails because those indexes were never primed.

apt's dists/** blobs are the reason GET /gc/orphans reports uncatalogued_by_design rather than offering to adopt them. Adopting them would hand the offline copy to garbage collection.

The proxy name is a URL prefix, so renaming it breaks the sources.list of every machine already pointed at it — and blob keys are <name>/<path>, so a naive rename also orphans everything already cached. Ours was called ubuntu-22.04 while serving 20.04, 22.04 and 24.04. Fixing that meant splitting one overloaded string into three: the name, an alias list so old URLs keep answering, and a pinned storage name so not one of the 607 cached objects moved. The alias then has to stay until nothing names it, which is a question only the access log can answer — and a machine that is merely switched off looks exactly like a machine that has been fixed.