apt-proxy/examples/config-template/apt-proxy.yaml at main · soulteary/apt-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# APT Proxy Configuration Example
# Copy this file to one of the following locations:
#   - ./apt-proxy.yaml (current directory)
#   - /etc/apt-proxy/apt-proxy.yaml (system-wide)
#   - ~/.config/apt-proxy/apt-proxy.yaml (user config)
#   - ~/.apt-proxy.yaml (user config)
#
# Or specify a custom path with: apt-proxy --config=/path/to/config.yaml
# Environment variable: APT_PROXY_CONFIG_FILE=/path/to/config.yaml
#
# Configuration priority: CLI flags > Environment variables > Config file > Defaults
#
# Every CLI flag has a 1:1 YAML / ENV equivalent; this file shows the full
# user-facing schema. See README "Configuration Options" for the flag table.

# Server configuration
server:
  # Network interface to bind to
  host: 0.0.0.0

  # Port to listen on
  port: 3142

  # Enable verbose debug logging
  debug: false

# Cache configuration
cache:
  # Directory to store cached packages
  dir: /var/cache/apt-proxy

  # Maximum cache size in GB (0 to disable size limit).
  # When exceeded, least-recently-used files are evicted automatically to keep total size within the limit.
  max_size_gb: 20

  # Cache TTL in hours (0 to disable TTL-based eviction)
  # Default: 168 (7 days)
  ttl_hours: 168

  # Cache cleanup interval in minutes (0 to disable automatic cleanup)
  # Default: 60 (1 hour)
  cleanup_interval_min: 60

# Storage backend (optional)
# By default the cache lives on the local filesystem (above). Switch to "s3"
# to keep every cached body/header in any S3-compatible object store
# (MinIO / Ceph / R2 / B2 / OSS / COS / AWS S3, ...). When backend is "s3"
# the cache.dir field above is ignored.
#
# A complete working example (compose stack with OtterIO, an Apache-2.0
# S3-compatible fork of MinIO) lives in examples/s3-otterio/.
storage:
  backend: disk           # "disk" (default) or "s3"
  s3:
    endpoint: ""          # host[:port], e.g. "s3.amazonaws.com" or "minio:9000"
    region: ""            # required for AWS S3, ignored by most MinIO services
    bucket: ""            # bucket must already exist
    prefix: apt-proxy/    # object key prefix
    access_key: ""        # prefer ENV: APT_PROXY_S3_ACCESS_KEY
    secret_key: ""        # prefer ENV: APT_PROXY_S3_SECRET_KEY
    use_ssl: true         # use HTTPS to talk to the endpoint
    use_path_style: false # MinIO/Ceph need true; AWS/R2/B2 use false
    inline_max_mb: 32     # writes <= 32 MiB stay in RAM, larger spill to temp_dir
                          # NOTE: this is a per-write cap; memory peak ~= concurrency * inline_max_mb.
                          # Lower this (e.g. 4-8) under high concurrency. See README "Resource sizing".
    temp_dir: ""          # empty = os.TempDir()

# Optional: path to distributions/mirrors YAML (distributions.yaml)
# Enables adding or editing distributions and mirrors without recompiling.
# Hot-reload with SIGHUP or POST /api/mirrors/refresh
# distributions_config: ./config/distributions.yaml

# Mirror configuration
# Use full URLs or shortcuts (e.g., cn:tsinghua, cn:ustc, cn:aliyun)
mirrors:
  # Ubuntu mirror
  ubuntu: cn:tsinghua

  # Ubuntu Ports mirror (for ARM, etc.)
  ubuntu_ports: ""

  # Debian mirror
  debian: cn:ustc

  # Optional dedicated Debian Security mirror (derived from Debian when empty)
  debian_security: ""

  # CentOS mirror
  centos: ""

  # Alpine mirror
  alpine: ""

# TLS/HTTPS configuration
tls:
  # Enable TLS
  enabled: false

  # Path to TLS certificate file
  cert_file: /etc/ssl/certs/apt-proxy.crt

  # Path to TLS private key file
  key_file: /etc/ssl/private/apt-proxy.key

# Security configuration
security:
  # API key for protected management endpoints
  # Supports environment variable expansion: ${APT_PROXY_API_KEY}
  api_key: ${APT_PROXY_API_KEY}

  # Enable API authentication (automatically enabled when api_key is set)
  enable_api_auth: true

  # API requests per IP per minute (0 disables; default 60)
  api_rate_limit_per_minute: 60

  # Trusted proxy CIDRs whose X-Forwarded-For is honored by the API rate
  # limiter and IP-based audit fields. Leave empty to ignore XFF entirely
  # (the secure default for direct-exposed deployments).
  # trusted_proxies:
  #   - 10.0.0.0/8
  #   - 192.168.0.0/16

# Upstream transport
# HTTP keep-alive to upstream mirrors. Disable only if a proxy / firewall
# in front mishandles persistent connections.
upstream_keep_alive: true

# Distribution mode
# Options: all, ubuntu, ubuntu-ports, debian, centos, alpine
mode: all