nuget-mirror / package pull-through cache

This host proxies and caches packages from api.nuget.org. Point dotnet/NuGet here to speed up restores and cut outbound rate-limit hits. Replace mirror.example.com below with this server's actual hostname.

01 — GLOBAL NUGET SOURCE

Add the mirror as a source

shell

dotnet nuget add source https://mirror.example.com/v3/index.json --name mirror
dotnet nuget disable source nuget.org

# confirm it took
dotnet nuget list source

This writes to the user-level NuGet.Config (%APPDATA%\NuGet\NuGet.Config on Windows, ~/.nuget/NuGet/NuGet.Config on Linux/macOS).

02 — PER-PROJECT (RECOMMENDED)

NuGet.Config in the repo root

Scope the mirror to a single solution and commit it, so every teammate and CI job restores through the mirror automatically.

NuGet.Config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="mirror" value="https://mirror.example.com/v3/index.json" />
  </packageSources>
</configuration>

The <clear /> drops any inherited sources (including nuget.org) so this project resolves only through the mirror.

03 — PRIVATE / INTERNAL FEEDS

Authenticated source

shell

dotnet nuget add source https://mirror.example.com/v3/index.json \
  --name mirror --username az --password YOUR_TOKEN --store-password-in-clear-text

NuGet.Config

<packageSourceCredentials>
  <mirror>
    <add key="Username" value="az" />
    <add key="ClearTextPassword" value="YOUR_TOKEN" />
  </mirror>
</packageSourceCredentials>

Never commit real credentials — use --store-password-in-clear-text only for local dev, and inject secrets via CI variables otherwise.

04 — CI/CD

Set the source in the pipeline

No repo changes needed if you'd rather not commit NuGet.Config — add the source as a pipeline step before restore.

shell

dotnet nuget add source https://mirror.example.com/v3/index.json --name mirror
dotnet restore

05 — VERIFY

Confirm restores are going through the mirror

shell

dotnet nuget list source
curl -s https://mirror.example.com/v3/index.json -o /dev/null -w "%{http_code}\n"

# restore something and time it
time dotnet add package Newtonsoft.Json --dry-run

Check	Expected result
`dotnet nuget list source`	Shows `mirror.example.com` as enabled
`GET /v3/index.json`	`200` with a service index — mirror is reachable
First restore of a package	Slower — cache miss, fetched from upstream and stored
Repeat restore	Fast — served from local cache

06 — NOTES

Pull-through, not a full copy. This mirror implements the NuGet V3 API and caches packages as they're requested — it doesn't proactively sync the entire nuget.org catalog. The first restore of any given package/version is still fetched from api.nuget.org.

dotnet nuget push still goes straight to the real feed (or wherever your .nupkg is configured to publish) — this mirror only accelerates restores. Package signature verification against nuget.org's certificate still applies unless you've explicitly disabled it, which keeps supply-chain integrity intact even when pulling through the mirror.