debian-mirror / apt pull-through cache

This host mirrors deb.debian.org and security.debian.org — main, contrib, non-free, and non-free-firmware — across the currently supported Debian releases, from oldstable through sid. Point apt here to speed up apt update/apt install and cut outbound bandwidth. Replace mirror.example.com below with this server's actual hostname.

01 — CLASSIC SOURCES.LIST

Full replacement, any suite

Substitute your release's suite name (bookworm, bullseye, trixie, sid) in place of <suite> below.

/etc/apt/sources.list

deb https://mirror.example.com/debian <suite> main contrib non-free non-free-firmware
deb https://mirror.example.com/debian <suite>-updates main contrib non-free non-free-firmware
deb https://mirror.example.com/debian <suite>-backports main contrib non-free non-free-firmware
deb https://mirror.example.com/debian-security <suite>-security main contrib non-free non-free-firmware

Debian security updates are published on their own debian-security archive, separate from the main debian tree — mirror both paths if you want that covered. Drop non-free/non-free-firmware if you only want fully free-software components.

02 — DEB822 FORMAT (TRIXIE+)

debian.sources

Debian 13 (Trixie) and later default to the newer Deb822 /etc/apt/sources.list.d/debian.sources format.

/etc/apt/sources.list.d/debian.sources

Types: deb
URIs: https://mirror.example.com/debian
Suites: <suite> <suite>-updates <suite>-backports
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: https://mirror.example.com/debian-security
Suites: <suite>-security
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

The existing debian-archive-keyring.gpg signature is unaffected by the source change — packages are still cryptographically verified the same way.

03 — SUPPORTED RELEASES

What this mirror carries

Suite	Role	Status
`sid`	Unstable	Rolling — always current, no freeze
`trixie`	Testing → Stable	Current stable release
`bookworm`	Oldstable	Maintained — LTS window
`bullseye`	Oldoldstable	EOL / ELTS only

Debian's release cadence isn't fixed — new stable releases ship "when ready." Check debian.org/releases for the current mapping of suite names to support status.

04 — DOCKER / CI

Repoint inside a build

Dockerfile

FROM debian:trixie
RUN sed -i 's|http://deb.debian.org|https://mirror.example.com|g; s|http://security.debian.org|https://mirror.example.com|g' \
      /etc/apt/sources.list.d/debian.sources && \
    apt-get update

Dockerfile

FROM debian:bookworm
RUN sed -i 's|deb.debian.org|mirror.example.com|g; s|security.debian.org|mirror.example.com|g' \
      /etc/apt/sources.list && \
    apt-get update

05 — VERIFY

Confirm apt is pulling through the mirror

shell

apt-cache policy | head -5
curl -s https://mirror.example.com/debian/dists/bookworm/Release -o /dev/null -w "%{http_code}\n"

# install something and time it
time sudo apt install -y curl

Check	Expected result
`apt-cache policy`	Lists `mirror.example.com` as a source
`GET /dists/<suite>/Release`	`200` — mirror is reachable
First install of a package	Slower — cache miss, fetched from upstream and stored
Repeat install elsewhere on the network	Fast — served from local cache

06 — NOTES

Package integrity is unaffected. Every .deb and its Release/Packages index is still verified against the Debian archive signing keys regardless of which mirror served the bytes — switching the source URL doesn't weaken that chain.

This mirror doesn't publish packages — there's no upload path here, only reads. Long-term support for very old releases (bullseye and earlier) moves to the community-run Debian LTS / ELTS archives, which are separate from the main deb.debian.org tree and would need their own mirror entry if needed. If it's served over plain HTTP internally, that's fine for apt — package signatures, not transport TLS, are what apt actually trusts.