An internal package mirror or cache for Linux clients: apt-cacher-ng and dnf's reposync

What it is

Two different approaches solve the same problem: many Linux clients on one network re-downloading the same packages from the internet. Apt-Cacher NG is a caching proxy for software packages downloaded by Unix/Linux system distribution mechanisms from mirror servers accessible via HTTP: Debian and Ubuntu clients point their APT configuration at it, and it fetches a package once, then serves later requests for the same file from its local cache. DNF's reposync plugin takes the opposite shape: it synchronizes packages of a remote DNF repository to a local directory, producing a complete local copy of a chosen repository (or a filtered subset) that RHEL-family clients then point baseurl at directly, rather than caching on demand.

Why it matters

Both approaches cut repeated downloads of the same packages to a single fetch from the internet, which matters most where bandwidth is limited or metered, or where many hosts update at the same time — a fleet of containers or VMs rebuilding together. A local mirror or cache also keeps package installation working during an upstream outage, as long as the needed packages were already fetched once. Neither approach should be used to skip signature verification: APT checks the signed repository metadata and the package hashes it lists, DNF checks package signatures (gpgcheck), both on the client against keys it already trusts, independently of where the bytes physically came from.

How to apply

• For Debian/Ubuntu, install apt-cacher-ng on one server, then point clients at it with Acquire::http::proxy "http://CacheServerIp:3142"; in an APT configuration snippet (it listens on TCP 3142) — client http:// sources need no change. https:// sources inherit this proxy setting as tunnels, which apt-cacher-ng passes (uncached) only if its PassThroughPattern allows them; otherwise set Acquire::https::Proxy "DIRECT";, or rewrite them to the cacheable http://HTTPS///host/... form.
• For RHEL-family systems, run dnf reposync --repoid=<repo> --download-metadata -p /srv/mirror (DNF 4 syntax, as on RHEL 8/9/10) on a schedule, adding --delete to drop packages removed upstream. --download-metadata makes the copy directly usable as a repository; without it, generate metadata with createrepo_c. Serve the directory over HTTP and point client repo files at it with baseurl.
• Set gpgcheck=1 and the vendor's original gpgkey= explicitly on every client repo definition pointing at the mirror; a local mirror is a transport optimisation, not a trust boundary, and reposync's own --gpgcheck flag can additionally remove packages that fail signature verification during the sync itself.
• Schedule reposync mirrors with a timer; apt-cacher-ng caches on demand and needs no schedule for freshness, only periodic expiry of superseded files (Debian's package installs a daily cron job for it).

Pitfalls

• Serving a reposync mirror without ever re-running it: clients get a frozen repository and silently miss security updates.
• Forgetting that a caching proxy still needs its own outbound internet access; it removes redundant fetches, not the need for connectivity entirely.
• Treating either tool as a substitute for GPG verification instead of a complement to it.