APT-CACHER(8)

📦 version 1.7.34, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 APT-CACHER(8) 🎀 — System Manager's Manual

okay so bestie, you opened the manual page for apt-cacher and honestly? it's giving networking icon, it's giving bandwidth savings, it's giving your whole house sharing one cache like a group chat sharing one braincell. Let's get into it 💖

✨ NAME ✨

apt-cacher — a caching proxy for Debian packages. that's the whole name, that's the whole vibe 🦋

🌸 SYNOPSIS 🌸

Server:

apt-cacher [-h|--help] [-i|-d] [-c configfile] [-p pidfile]
           [-r directory] [-R retries] [config_option=foo]

Client:

http://apt-cacher.server:3142[/apt-cacher]/{mirror}/{distribution}

💫 DESCRIPTION 💫

So apt-cacher is a caching proxy for Debian packages, and the entire point is that a bunch of computers get to share one single cache. Here's the tea: packages requested from the cache only get downloaded from the Debian mirrors once, no matter how many local machines need to install them. Which means — say it with me — it saves network bandwidth, it improves performance for the users, and it reduces the load on the mirrors. slay. periodt. 👑

And like, it's not just HTTP. Besides proxying and caching HTTP requests, apt-cacher can also proxy and cache FTP and HTTPS GET/HEAD requests, Debian bugs SOAP requests, and it can proxy — but not cache — HTTPS CONNECT requests. multi-talented fr fr 💅

🔥 COMMAND-LINE OPTIONS 🔥

  • -c configfile — point it at a different config file than the default. The default is [/etc/apt-cacher/apt-cacher.conf], just so you know 👀
  • -d — stand-alone daemon-mode. it forks and runs in the background, main character energy, doesn't need anyone 🫶
  • -h, --help — prints a brief usage. short and sweet, no yapping ✨
  • -i — inetd daemon-mode. only use this in /etc/inetd.conf, bestie, don't get creative with it 🙈
  • -p pidfile — writes the PID of the running process into this file. so you can find it later 💖
  • -r directory — experimental option to chroot to the given directory. experimental!! be aware ⚠️
  • -R retries — how many attempts to bind to the daemon port 🔁
  • -v, --version — shows the version and exits. bye 👋
  • config_option=value — overrides values in the configuration file. you can pass this multiple times, stack 'em up 🌈

🦋 USAGE 🦋

Setting up apt-cacher is a two-stage situation: stage one, install apt-cacher itself on a single machine on your network so it can act as the server. stage two, configure all the client machines to use that server's cache. two steps, no chaos 💅

apt-cacher can run either as a daemon — which is the preferred way — or as a CGI script on a web server like Apache, which is deprecated. When a client (think apt-get(1), aptitude(8), synaptic(8), etc.) asks the cache machine for a package, the request is handled by apt-cacher, which checks whether it already has that particular package. If it does? the package is returned to the client immediately for installation, no waiting, we love to see it. If it doesn't, or if the package sitting in the local cache has been superseded by a more recent version, then the package gets fetched from the specified mirror. And while it's being fetched, it's simultaneously streamed to the client and saved to the local cache for future use. multitasking queen 🧚

Here's the best part: the other client machines on your network don't need apt-cacher installed to use the server cache. The only change on each client computer is directing it to use the server cache. Check out CLIENT CONFIGURATION below for ways of doing that 👑

👑 SERVER INSTALLATION 👑

You can install apt-cacher on the server in various ways. The recommended way is running the program as a daemon — that should give you the best performance and the lowest overall memory usage 💖

And the easiest method of configuration? use dpkg-reconfigure(8) and let debconf(1) do the work for you. literally it will handle it. obsessed 🌸

🌈 Daemon Modes

You pick between stand-alone daemon mode, where the daemon just runs continuously, and inetd mode, where the daemon is run as required by the inetd(8) superserver.

In either daemon mode, clients can access the server using http://apt-cacher.server:port/ ✨

🌟 Stand-alone Daemon:

(yes bestie, that's the one that just chills and runs all the time, described up above 💖)

💜 Inetd Daemon:

NOTE: in inetd mode, access control checks are not performed, and the allowed_hosts and denied_hosts options have no effect. Access controls for inetd can be implemented using inetd or tcpd wrapper. See inetd.conf(5) and hosts_access(5) for further details.

like, read that twice. the vibes are secure-ish but the built-in access control is not there 🚨

🍓 CGI Mode

Okay so this mode is deprecated and not recommended for long-term use, because it brings a visible performance impact on the network and server speed. To use it you'll need to make sure your webserver supports CGI. Clients can access the server using http://apt-cacher.server[:port]/cgi-bin/apt-cacher/.

Migrating away from deprecated CGI mode can be smoothed using the following configuration options:

  • cgi_advise_to_use [] — this is a custom error message used to advise clients to use an alternative to CGI 💌
  • cgi_redirect [] — if set, this option is an absolute URL used to redirect any CGI requests. it can be used to seamlessly redirect CGI access to an instance of apt-cacher running as an INETD or stand-alone daemon. the glow-up arc 🔁

🎀 SERVER CONFIGURATION OPTIONS 🎀

apt-cacher uses a configuration file for setting the important options. On top of that there are a few command-line options to control behaviour — see COMMAND-LINE OPTIONS above 👀

The default configuration file is /etc/apt-cacher/apt-cacher.conf. It gets read every time the daemon starts, or every time an inetd/CGI instance is executed. Which means a stand-alone daemon may need to be restarted or reloaded using the init script so it rereads its configuration. A running daemon will also reread the configuration file on receiving SIGHUP (see SIGNALS below) ✨

As an alternative to editing the config file, you can drop configuration fragments that override the defaults into a directory named conf.d in the same directory as the main configuration file, e.g. /etc/apt-cacher/conf.d/. Files in there can have an arbitrary name. They're read using glob(7) semantics: case-insensitive, ascending ASCII order; dot-files (those starting with .) are ignored. Also ignored: backup files ending with ~, and any files ending with .disabled or .dpkg-{old,new,dist,tmp}. And duplicate settings read later will override any previous ones — last one wins, sorry to the earlier girlies 💅

Each line in the file consists of

configuration_option = value

Long lines can be split by putting \ before the newlines. Whitespace is ignored. Lines beginning with # are comments and get ignored. If the same option gets assigned multiple times, only the last one takes effect. For binary options, 0 means off or disabled, and any other integer means on or enabled. Options that accept lists can use either ; or , to separate the individual list members. And if you need those separators inside a list item, escape them with \ 🫶

The options available in the config file (and their default settings) are:

💖 Universal Options 💖

  • admin_email — default [root@localhost]. The email address of the administrator, displayed in the info page and the traffic reports 📧
  • allowed_locations — only allow access to specific upstream mirrors. The requested URL must match an item in this list for access to be granted. The part of the URL referring to the apt-cacher server itself (http://apt-cacher.server:port[/apt-cacher]/) is ignored, and matching begins immediately after that. If %PATH_MAP% is included in this option, it will be expanded to the keys of the path_map setting. Note that this item contains string(s), not regexps 👀
  • allowed_ssl_locations — default []. Only allow HTTPS/SSL proxy CONNECT to hosts or IPs which match an item in this list 🔒
  • allowed_ssl_ports — default [443]. Only allow HTTPS/SSL proxy CONNECT to ports which match an item in this list. Adding further items to this can pose a significant security risk. DO NOT do it unless you understand the full implications. seriously bestie, don't 🚨
  • cache_dir — default [/var/cache/apt-cacher]. The directory where apt-cacher stores local copies of all packages requested. This can grow to many hundreds of MB, so make sure it's on a partition with plenty of room. NOTE: the cache directory needs to contain some subdirectories for correct storage management. If you try to create a custom directory, please use the script /usr/share/apt-cacher/install.pl, or use the initially created cache directory as an example 📦
  • concurrent_import_limit — default [Number of CPU cores from /proc/cpuinfo or 0]. Importing new checksums can cause high CPU usage on slower systems. This option sets a limit on the number of index files imported simultaneously, which limits the CPU load average but possibly takes longer. Leave it unset or set it to 0 for no limit 🔥
  • checksum — default [0]. Switches on checksum validation of cached files. Checksum validation will slow apt-cacher's response down, because requested files have to be downloaded completely before validation can occur. You can prevent that slow down by setting this value to lazy, in which case files are passed on as they are received and checked afterwards. Requires the package libberkeleydb-perl to be installed ✅
  • checksum_files_regexp — default [see default /etc/apt-cacher/apt-cacher.conf]. A Perl regular expression (perlre(1)) which matches the URL filename of all index files from which checksums are imported into the checksum database, if checksum mode is enabled 🔍
  • clean_cache — default [1]. Whether to flush obsolete versions of packages from your cache daily. You can check what will be done by running
/usr/share/apt-cacher/apt-cacher-cleanup.pl -s

which will just show what would be done to the contents of the cache. A package is only obsolete if none of the (optional) namespaces, distributions (stable, testing, etc) or architectures you use reference it. It should be safe to leave this on 🧹

  • curl_idle_timeout — default [120]. The maximum time in seconds the libcurl backend will wait, unused, before exiting ⏳
  • curl_ssl_insecure — default []. If this is set to 1, HTTPS GET requests (which are inherently insecure, as transfer from the proxy to the client is unverified) become even less secure, because the libcurl backend skips peer verification with the upstream source. You really shouldn't use this. HTTPS CONNECT proxying is more secure. like, actually don't 🙈
  • curl_throttle — default [10]. Controls how fast the libcurl process runs. Increasing this setting will reduce the CPU load of the libcurl process, possibly at the expense of slower response times and lower throughput. On most systems this option should be left unchanged 💅
  • data_timeout — default [120]. Time in seconds after which a request will timeout if no data is received from upstream. This option used to be known as fetch_timeout — the old name is still recognised for backwards compatibility 🕰️
  • debug — default [0]. Whether debug mode is enabled. Off by default. When turned on (non-nil), lots of extra debug information gets written to the error log. This can make the error log become quite big, so only use it when you're trying to debug problems. Additional information from the libcurl backend can be obtained by increasing this parameter. The correspondence between this setting and curl_infotype is:
1      CURLINFO_TEXT
  1. CURLINFO_HEADER_IN
  2. CURLINFO_HEADER_OUT
  3. CURLINFO_DATA_IN
  4. CURLINFO_DATA_OUT
  5. CURLINFO_SSL_DATA_IN
  6. CURLINFO_SSL_DATA_OUT

and if you want the whole lore on that list, go peep CURLOPT_DEBUGFUNCTION in curl_easy_setopt(3). bestie, it's all there 🫶

  • disk_usage_limit [] — optional upper limit on how much disk space cache_dir is allowed to eat, measured in bytes. Units like k, KiB, M, MiB etc. get recognised with the same semantics as the rate limit option above. so yes, you can say 2G and it'll get it 💅
  • distinct_namespaces [0] — set this to 1 and you unlock caching of multiple Distributions (think Debian and Ubuntu) from one single apt-cacher instance. when it's on, package files get stashed in a subdirectory whose name comes from the matching key of path_map, or from the part of the URL that comes before pool or dists. that's typically ´debian', 'ubuntu' or 'security'. this mechanism is literally there so the Distributions don't clash.

⚠️ heads up though: if you turn this option on, any existing namespace specific package files that aren't sitting in the correct subdirectory of cache_dir would be deleted by apt-cacher-cleanup.pl. so if you wanna keep them and import them into the correct namespace, run this (as root):

/usr/share/apt-cacher/apt-cacher-import.pl -u
{cache_dir}/packages

and if you wanna limit which namespaces are even possible, see path_map.

  • expire_hours [0] — how many hours Package and Release files get cached before they're assumed too old and must be re-fetched. setting it to 0 means the validity of these files gets checked on every single access, by comparing the time stamps in the HTTP headers on the server with the ones stored locally. ngl, using this setting is deprecated — HTTP header validation and sending If-Modified-Requests is so much more efficient.
  • generate_reports [1] — whether to generate traffic reports daily. you can reach those reports by pointing a browser at
http://apt-cacher.server:3142/report/ [daemon mode]

or

http://apt-cacher.server[:port]/apt-cacher/report/ [CGI
mode].
  • group [www-data] — the effective group id to change to.
  • http_proxy [] — apt-cacher can pass all its requests to an external http proxy like Squid, which is genuinely a lifesaver if your ISP blocks port 80 and forces all web traffic through its proxy. the option takes a URI shaped like
[protocol://][user[:password]@]hostname[:port]

the default protocol is http and the default port is 1080.

  • http_proxy_auth [] — external http proxies sometimes need authentication for full access. format is 'username:password', eg: 'proxyuser:proxypass'. this option is deprecated though — proxy auth details should be specified in the http_proxy URI instead.
  • index_files_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (perlre(1)) matching the URL filename of all index-type files. those are the files that are uniquely identified by their full path and need to be checked for freshness. ✨
  • installer_files_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (perlre(1)) matching the URL filename of all files used by Aptitude, Apt, the Debian/Ubuntu installer or Debian Live. those are the files uniquely identified by their full path but that don't need a freshness check. inside this item, the shorthand '%VALID_UBUNTU_RELEASE_NAMES%' gets expanded to the list configured in ubuntu_release_names, as regexp alternatives. cute, right?
  • interface [] — pick a specific interface for the upstream connection. can be an interface name, an IP address or a host name. if it's unset, the default route gets used.
  • libcurl [] — a list of configuration options for the libcurl backend. each item is the curl_easy_setopt(3) option (without the CURLOPT_ prefix) plus the setting you want. for example:
libcurl = dns_cache_timeout 300, maxredirs 10, noproxy
localhost;
🚨 bestie be very careful with this one. Apt-cacher depends on the libcurl backend working in a predictable way, and you can very easily break things by configuring this. no cap.
  • limit [0] — rate limiting! sets the maximum rate in bytes per second used for fetching files from the upstream mirrors. optionally use SI unit abbreviations ('k', 'M', 'G' etc.) for decimal multiples (1000) or 'KiB', 'MiB', or 'GiB' etc. for binary (1024) multiples. legacy lowercase suffixes based on wget(1) syntax get interpreted as decimal for backwards compatibility, but honestly should be avoided in new configurations. use 0 for no rate limiting. by default this setting is per libcurl connection. for global limiting, see limit_global below. 👑
  • limit_global [0] — if set, this makes the specified rate limit apply overall. the libcurl backend doesn't have good support for this, so it's implemented by a simple division of the rate by the total number of downloads. there is no way for downloads to dynamically use bandwidth released by another idle/finished download. if you really want good global bandwidth control, don't use this option at all; use traffic shaping instead. fr fr.
  • log_dir [/var/log/apt-cacher] — directory to use for the access and error log files and the traffic report. the access log records all successful package requests using a timestamp, whether the request was fulfilled from cache, the IP address of the requesting computer, the size of the package transferred, and the name of the package. the error log records major faults, and it's also used for debug messages if the debug directive is set to 1. debugging is toggled by sending SIGUSR1 (see SIGNALS below). 📝

this option was formerly named 'logdir', but was renamed for consistency. logdir is still recognised but should not be used for new installations.

  • max_loadavg [] — if set, this limits the maximum 1 minute loadavg permitted for apt-cacher to attempt to handle a client connection.
  • offline_mode [0] — avoid making any outgoing connections. return files available in the cache, or just return errors if they're missing. lowkey the introvert setting of apt-cacher 🫶
  • package_files_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (refer to the perlre(1) manpage) matching the URL filename of all package-type files, i.e. the files that are uniquely identified, within their Distribution, by their filename.
  • path_map [] — a mapping scheme that rewrites URLs, converting the first part of the URL after the apt-cacher server name (the key) into a remote mirror. for example, if you set
path_map = debian ftp.debian.org/debian

then retrieving

http://apt-cacher.server:3142/debian/dists/stable/Release

will actually fetch

http://apt-cacher.server:3142/ftp.debian.org/debian/dists/stable/Release

if distinct_namespaces is set, you can use multiple mappings to cache different Distributions separately. for example

path_map = debian ftp.debian.org/debian; ubuntu
archive.ubuntu.com/ubuntu

multiple, space separated, mirrors can be given for each mapping. they'll be tried in order if the previous one fails or is unavailable. for example

path_map = debian ftp.uk.debian.org/debian
ftp.debian.org/debian ;

all path_map keys need to be included in allowed_locations, if the latter is used. the shorthand '%PATH_MAP%' can be used to simplify this. 🎀

there are 4 internal path_map settings for the Debian and Ubuntu changelog and AppStream servers, which will be merged with the specified configuration:

debian-changelogs packages.debian.org
metadata.ftp-master.debian.org; ubuntu-changelogs
changelogs.ubuntu.com; debian-appstream
appstream.debian.org; ubuntu-appstream
appstream.ubuntu.com;

these can be overridden by specifying an alternative mirror for that key, or deleted by just specifying the key with no mirror.

  • pdiff_files_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (perlre(1)) matching APT pdiff files. these are ed(1) scripts which APT uses to patch index files instead of redownloading the whole file afresh. iconic energy honestly.
  • return_buffer_size [1048576] — the buffer size used for reads when returning a file using the slower read/write loop. the default is 1MB. you might wanna adjust this to trade speed against memory consumption. by default though, files are returned using sendfile(2), which is much faster and doesn't make use of this setting at all. 💅
  • reverse_path_map [1] — this setting enables a reverse map from the requested URL to the path_map key. it helps prevent having multiple copies of the same file cached under different file names.
  • skip_checksum_files_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (perlre(1)) matching the URL filename for which checksum validation is not performed. note that all files matched by installer_files_regexp are automatically skipped and don't need to be added here as well. so don't do extra work, bestie.
  • soap_url_regexp [see default /etc/apt-cacher/apt-cacher.conf] — a Perl regular expression (perlre(1)) matching URLs that are permitted as an upstream source for apt-listbugs(1) requests.

apt-listbugs(1) makes requests to the Debian Bugs server via SOAP POST requests. these are not cached, but are simply passed through as a convenience.

  • supported_archs [see default /etc/apt-cacher/apt-cacher.conf] — a list of Architectures that are supported and that you wish to allow in fetched filenames. ´all´ and ´any´ are automatically added to this list, which is then used to expand %VALID_ARCHS% in *_files_regexp. 🌈
  • use_proxy use_proxy_auth [obsolete] — use of external proxy and proxy authentication used to be turned on or off with these options. they are now ignored, and an upstream proxy will always be used if configured.
  • use_sendfile [Sys::Syscall::sendfile_defined()] — okay so if sendfile(2) is a thing on your system, apt-cacher uses it to hand files back to the client and it's so much more efficient than read/write, like not even a competition 💅. That default is literally just whatever Sys::Syscall::sendfile_defined() returns, but you can override it explicitly if you want to be that girl.
  • user [www-data] — the effective user id it switches to after it's done grabbing the ports. Ports first, identity crisis later ✨.

👑 Stand-alone Daemon-mode Options 👑

  • allowed_hosts [empty] — bestie, if your apt-cacher server is sitting directly on the internet and you're lowkey stressed about randoms pulling packages through it, this is your girl. You give her a range of IP addresses that are allowed to use it. Localhost (127.0.0.1/8, ::1) is always allowed, everyone else has to match allowed_hosts and not match denied_hosts to get in. This option can be a single item, a list, an IP address with netmask or IP range, a resolvable hostname, or * to allow absolutely everyone in (main character behaviour, risky though). Peep the default config file for more details and examples 💖.
  • allowed_hosts_6 — deprecated option, same vibe as allowed_hosts but for IPv6 clients. Plot twist: allowed_hosts can now take IPv6 addresses directly, so this one's just vibing in the past 🦋.
  • daemon_addr [empty] — lets you restrict the daemon to listening only on particular local IP address(es). If it's unset, the daemon listens on all available addresses. Single item or a list of IPs. > Use with care, okay? That's not me being dramatic, that's the manpage 😭
  • daemon_port [3142] — the TCP port to bind to. The moment of truth 🔥.
  • denied_hosts — the opposite of allowed_hosts, it kicks hosts out of the allowed list. Not used in inetd daemon mode, just so you know.
  • denied_hosts_6 — deprecated option, analogous to denied_hosts but for IPv6 clients. Again: denied_hosts can now take IPv6 addresses directly, no need for the split 🎀.
  • request_empty_lines [5] — how many empty lines it'll tolerate before it closes an incoming connection. Five strikes and you're out 💀.
  • request_timeout [30] — maximum time in seconds it waits for an incoming request before it closes the connection. Thirty seconds of silence and she's moving on, no cap ⏳.

🫶 CLIENT CONFIGURATION 🫶

There are two different ways of configuring clients to use apt-cacher's cache, and bestie, listen to me: do not mix them. Changing both proxy settings and base URLs at the same time is giving chaos, and it will create some confusion. Pick a lane, slay in it 💅.

🌸 Access cache like a mirror 🌸

To use the cache this way, edit /etc/apt/sources.list on every client and prepend the address of the apt-cacher server to each deb/src line. Heads up though: this mode is limited to using HTTP protocol for the upstream source.

So for example, if you have:

deb http://ftp.debian.org stable main

change it to read either

deb http://apt-cacher.server[:port]/ftp.debian.org stable main [server in daemon mode]

or

deb http://apt-cacher.server[:port]/apt-cacher/ftp.debian.org stable main [server in CGI mode]

Two paths, one cache, iconic ✨

🌈 Access cache like a proxy 🌈

For clients to use the cache this way, you set the apt-cacher server as a proxy on each client by putting the proxy URL in apt.conf. Like so:

Acquire::http::Proxy "http://apt-cacher.server:port";

See apt.conf(5) for the full rundown 📖.

It is not recommended to set the http_proxy environment variable, because that may affect a wide variety of applications using a wide variety of URLs. And fr fr — Apt-cacher will not work as a general purpose web cache! She has a job and it's a specific one 😤

In this mode apt-cacher supports HTTP, FTP, HTTPS CONNECT, HTTPS GET and Debian Bugs SOAP proxying. Versatile queen 👑.

💬 FAQ 💬

Q: Can I just copy some .debs into the cache dir and have it work?

A: Almost! A bit of additional work is also required to make them usable and persistent in the cache.

First: alongside the .debs, apt-cacher stores the HTTP headers that were sent from the server. If you copy .debs straight into the storage directory and don't add those things, fetching them will fail. Not a maybe, a will 😭.

Fortunately Apt-cacher now comes with an import helper script to make things easier. Just put a bunch of .debs into /var/cache/apt-cacher/import (or a directory called import inside whatever you've set your cache dir to be), and run /usr/share/apt-cacher/apt-cacher-import.pl — you can specify an alternative source directory with the first parameter. The script will run through all the package files it finds in that dir and move them around to the correct locations, plus create additional flag/header files. Run it with -h to get more information about how to use additional features — it can work in recursive mode while discovering the files, and save space by making links to files located elsewhere in the filesystem. Multi-talented, honestly 🧚

Second: if the daily cleanup operation is enabled (see the clean_cache option above) and there is no Packages.gz (or .bz2) file that refers to the new files, the package files will be removed really soon. From another point of view though: if there are potential clients that would download these packages, and those clients did run apt-get update using apt-cacher once, there is no reason to worry. You're fine, breathe 🫶

Q: I have an invalid/corrupt file in the cache, how can I remove it?

A: There are several possibilities for this:

  1. In either daemon mode, apt-cacher tries to be a well-behaved cache and respects Cache-Control and Pragma headers. Refreshing a file can be forced by adding Cache-Control: no-cache to the request. The easiest way of doing this is with the --no-cache option of wget(1), for example:
wget -O/dev/null --no-cache http://localhost:3142/debian/dists/stable/Release
  1. Enable checksumming, which will validate cached files as they are fetched.
  2. Wait until after apt-cacher-cleanup.pl has run (which should remove invalid files).
  3. Manually delete the file from /var/cache/apt-cacher/packages.

Q: Does the daily generation of reports or cleaning the cache depend on whether apt-cacher is running continuously as a daemon?

A: No — the regular maintenance jobs are independent of a running server. They are executed by cron(8) and use only static data like logs, cached index files and the package directory listing. However, apt-cacher should be configured correctly, because cleanup runs it directly (in inetd mode) to refresh the Packages/Sources files. Independence, but with strings attached 💫

Q: Are host names permissible in the configuration file?

A: Since 1.7.0, DNS resolvable hostnames are permissible ✨.

Unlike with some other software like Apache, the access control is slightly different because there is no configurable checking order. Instead, a client host is checked using both filters, allowed_hosts and denied_hosts. Following combinations are possible:

  • allowed_hosts=* and denied_hosts is empty → then every host is allowed.
  • allowed_hosts=<ip data> and denied_hosts=empty → then only defined hosts are permitted.
  • allowed_hosts=* and denied_hosts=<ip data> → then every host is accepted except those matched by denied_hosts.
  • allowed_hosts=<ip data> and denied_hosts=<ip data> → then only the clients from allowed_hosts are accepted, except those matched by denied_hosts.

allowed_hosts=<empty> blocks everything (except localhost). And denied_hosts must not have an * value — use an empty allowed_hosts setting if you want that. Rules are rules, bestie 💅

Q: generate_reports: how does being able to view the reports depend on the web server you are running? Are they only available if apt-cacher is running on port 80?

The report is generated using a script (started by a cron job, see above) and is stored as $log_dir/report.html. You can access it using the /report path in the access URL. If apt-cacher is running in CGI mode, then the URL for the browser looks like http://apt-cacher.server[:port]/apt-cacher/report/. Port 80 who? Never heard of her 🌸

🚧 LIMITATIONS 🚧

Apt-cacher currently handles forwarding GET requests to HTTP, FTP and HTTPS sources. Support for other access methods (ssh, rsync) is not currently planned. She knows what she is and what she isn't 💅

⭐ SIGNALS ⭐

Apt-cacher handles the following signals:

  • HUP — causes the configuration file to be re-read. Glow-up reload ✨
  • USR1 — toggles printing of debug output to /var/log/apt-cacher/error.log. Peek behind the curtain 🔍

📁 FILES 📁

  • /etc/apt-cacher/apt-cacher.conf — main configuration file
  • /etc/apt-cacher/conf.d/ — configuration fragments directory
  • /var/cache/apt-cacher/ — cache/working directory
  • /var/log/apt-cacher — log directory, rotated by logrotate(8) if available
  • /var/log/apt-cacher/report.html — report page, generated by the helper script

The whole family, all together, so cute 🎀

👑 AUTHOR 👑

Apt-cacher was originally written by Nick Andrews <nick@zeta.org.au>. This manual page was originally written by Jonathan Oxer <jon@debian.org>, for the Debian GNU/Linux system (but may be used by others). It was maintained by Eduard Bloch <blade@debian.org>, and it is now maintained by Mark Hindley <mark@hindley.org.uk>. A whole lineage of legends keeping this thing alive, we love to see it 🫶💖

And that's a wrap on the APT-CACHER(8) era, bestie — this whole glow-up is from the APT-CACHER(8) manual page in the apt-cacher package, dated 2024-07-27 💅✨ go forth and cache responsibly 🦋

📦 where this page comes from