go

/go/

Go modules, through the proxy the toolchain already wants

Point your client at it

bash

export GOPROXY=http://HOST:10220/go
export GOSUMDB=off

Replace HOST with your mirror’s address. Port 10220 is the server’s default.

Upstream: https://proxy.golang.org
What is stored: Module zips in the blob store and catalogued; version lists on local disk.

How it works

Go needs the least persuading of any ecosystem here: the toolchain already expects a proxy rather than a direct clone from GitHub. Set GOPROXY and every go mod download comes through LibWorld, which answers the four things the toolchain asks for — @v/list, @v/<version>.info, .mod and .zip.
A published module version can never change, because Go module storage is content-addressed. So a cached zip is safe to serve forever and LibWorld never re-checks one upstream.
The GOSUMDB=off in the config above is doing something you should understand rather than paste. Go's checksum database is a separate Google service, so leaving it on means every build still phones home — which defeats the point. You are not turning off integrity by setting it: each module zip still carries its own hash, and the go.sum committed in your repo still pins exactly what you expect. What you give up is the notary's opinion on modules you have never fetched before.

Things that have cost real time

Written down because they were paid for once already.

GOSUMDB=off is part of the client configuration above and it is not decoration. The checksum database is a separate upstream service, so a build pointed only at the mirror still reaches out to sum.golang.org — which is exactly the call an air-gapped build cannot make, and the mirror cannot answer on its behalf.