Latest / Linux Server Admin with Fexingo: Sysadmin, Bash, and Server Engineering / How to Speed Up Linux Server Package Updates with Apt-Cacher NG
Transcript
- Lucas: You manage a dozen Ubuntu servers. Every time you run apt-get update, each one re-downloads the same package lists and headers from the internet. That's bandwidth you're paying for twice, and time you're spending waiting. Luna: Yeah, and if you've got a 50-server fleet, it's fifty redundant downloads. I've definitely sat there watching progress bars more than I'd like. Lucas: Exactly. So let's fix that with a tool called apt cacher ng. It's a caching proxy for Debian-based package managers. You point all your servers at one machine that caches every.deb and Package.gz it fetches. Next time another server asks for the same file, it serves from local storage. Luna: So the first request is still outbound, but every subsequent one is LAN speed. How do you set it up? Lucas: On your cache server — could be an old desktop or a VM — install the package: sudo apt-get install apt cacher ng. That's it. It starts a service on port 3142. By default it stores cache under /var/cache/apt cacher ng. Luna: Default config good enough for a lab, or do you need to tweak? Lucas: For a small fleet it's fine. But the config file is at /etc/apt cacher ng/acng.conf. You'll want to adjust CacheDir if you don't have space on root. Also set the number of threads: use ConcurrencyLevel equal to your core count. And set ExTreshold to something like 14 to avoid purging files too aggressively. Luna: What about the clients? Do they all need a new sources.list? Lucas: Yes, but you don't touch sources.list directly. Better to create a proxy config file: /etc/apt/apt.conf.d/00proxy. Add one line: Acquire::http::Proxy "http://your cache ip:3142"; That overrides all HTTP requests from apt to go through the proxy. Luna: So every apt-get update and install on that client will hit the cache. What about HTTPS repos? Some PPAs use HTTPS. Lucas: Good catch. By default apt cacher ng only caches HTTP. For HTTPS, you need to enable SSL tunneling in acng.conf: set UseProxySSL to 1 and add the CA certificate. But honestly, for most internal use, HTTP mirrors work fine. You can use a local mirror like archive.ubuntu.com over HTTP. Luna: Makes sense. Let's say I have a 50-node cluster. What kind of bandwidth savings are we talking? Lucas: A typical apt-get update pulls about 30 megabytes of package lists. Multiplied by 50 is 1.5 gigabytes every time. With the cache, it's 30 megs outbound once, then LAN copies. On a gigabit network, those updates go from minutes to seconds. Luna: And if today's tech conversation gave you something usable, that's exactly what we're here for. A handful of listeners already chip in monthly through buy me a coffee dot com slash fexingo, and that support literally keeps this show ad-free and focused on practical stuff. Lucas: Yeah, it's a small group but it makes a big difference. No ads, no sponsors — just real sysadmin workflows. So back to apt cacher ng: once you've got the proxy running, you want to monitor it. There's a web interface on port 3142/acng-report.html. Shows hit rate, cache size, and how many requests bypassed the cache. Luna: Hit rate is the key metric. What's a good number? Lucas: After the first full update cycle, you should see 70-90% cache hits. If it's lower, check that all clients point to the same proxy and that the cache isn't filling up. You can also preheat the cache by running apt-get update on one machine first. Luna: Preheating — that's a good tip. So you manually update one node, let it cache everything, then update the rest. Lucas: Exactly. One more thing: watch out for stale cache. If a package gets updated upstream, the cache might serve the old version. apt cacher ng handles this with checksum verification by default, but you can force a refresh by deleting files in /var/cache/apt cacher ng or restarting the service. Rarely needed, but good to know. Luna: So it's mostly fire and forget. Install, configure, and your fleet updates faster. I'm sold. Lucas: Yeah, it's one of those tools that pays for itself in time saved within the first week. And it's free, open-source, in the default repos. No reason not to set it up.