This tutorial points APT on Debian 12 (bookworm) at a Virtual Registry that caches the Debian archive on deb.debian.org.
virtual_registry:
registries:
- name: deb
remotes:
- url: https://deb.debian.org
The examples below reach the registry as https://deb.example.com, a host that the registry named deb answers (see name). A path on the registry is the same path on the remote, so the archive at https://deb.debian.org/debian is at https://deb.example.com/debian. Package types describes how each file is cached.
In /etc/apt/sources.list.d/debian.sources, put the registry in place of http://deb.debian.org on each URIs line:
Types: deb
URIs: https://deb.example.com/debian
Suites: bookworm bookworm-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb
URIs: https://deb.example.com/debian-security
Suites: bookworm-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
A host that lists its sources in /etc/apt/sources.list instead takes the same URLs there:
deb https://deb.example.com/debian bookworm main
APT reaches the registry over HTTPS only once the ca-certificates package is installed, which the Debian container images leave out. Install it before switching the sources.
The registry serves the archive’s InRelease and Release.gpg as the remote publishes them, so APT checks their signatures against the same key as before.
apt-get update
apt-get install hello