When working remotely with a limited bandwidth available, it is important to minimize as much as possible the repeated downloading of Debian packages via Apt. One way of doing this is to add an Apt Cache Proxy to the host running the TurnKey GNU/Linux Portable Development Environment (PDE). On the other hand, we wish to avoid multiple caches of the same file. The LXC appliance caches downloaded proxmox formated images. The TKLdev appliance, by default, uses Polipo to cache all downloaded files including deb packages.

1) Choosing an Apt Cache Proxy

a) squid-deb-proxy

• Installs squid3 and sets up two proxies, one for HTTP and one for Apt
• Could not get the apt proxy to accept PPA or TurnKey packages

b) polipo

• Lightweight proxy used by TKLdev appliance
• Support for polipo has been discontinued https://www.irif.fr/~jch//software/polipo/

c) apt-cacher-ng

• Next generation replacing apt-cacher
• This is the package we choose to use

2) Install apt-cacher-ng

sudo apt-get -qy update
sudo apt-get -qy install -t xenial-backports apt-cacher-ng

3) Create 01proxy and Install on all clients

Set the proxy for host to localhost.

echo "Acquire::http { Proxy "http://127.0.0.1:3142"; };" | sudo tee /etc/apt/apt.conf.d/01proxy

Set the proxy for containers to the LXD bridge interface.

PROXY=$(lxc network get lxdbr0 ipv4.address)
echo "Acquire::http { Proxy "http://${PROXY%/[0-9]*}:3142"; };" > 01proxy

For each container, push the 01proxy file and restart apt if the container is running

for container in $(lxc list --format=csv -cn); do
lxc file push 01proxy ${container}/etc/apt/apt.conf.d/01proxy --uid=0 --gid=0
done

4) Ensure clients only use http:// urls in source lists.
apt-cacher-ng refuses to cache https:// urls.

5) Configure apt-cacher-ng to pass through HTTPS requests
Add the following line to /etc/apt-cacher-ng/acng.conf

PassThroughPattern: .* # this will allow CONNECT to everything including HTTPS

and then restart

sudo service apt-cacher-ng restart

6) Configure firewall to allow containers to access apt-cacher-ng

sudo ufw allow in on lxcbr0 to any port 3142 proto tcp
sudo ufw allow in on lxdbr0 to any port 3142 proto tcp

7) The TKLdev appliance needs some additional configuration
Change the FAB_APT_PROXY in the container /root/.bashrc.d/fab to use apt-cacher-ng.
Replace 10.76.85.1 with the PROXY address from step 3. 

export FAB_APT_PROXY=http://10.76.85.1:3142

Leave the FAB_HTTP_PROXY pointing to polipo on the localhost

export FAB_HTTP_PROXY=http://127.0.0.1:8124

Note: Edited 02/21/2018 to use 01proxy which may exist in some appliances and to push files as root:root.

If you have been using TurnKey PDE (portable development environment) on Ubuntu 16.04 LTS, then you have probably experienced the warning about needing to run a partial upgrade due to package conflicts.  The problem apparently arises from our use of LXC and LXD packages from `xenial-backports`.  It's taken some time to figure out a remedy, but I have released a new version of TurnKey PDE which deals with the introduction of version 3.0.1 of LXC & LXD that were released to `xenial-backports`.

You can clone the new version, turnkey-pde v1.2, from github or if you have previously cloned an earlier version, use `git pull origin master`.  Then run `./pde-setup` for a new installaion or `./pde-setup --update` to update an older version.

In the event that you ran the partial upgrade, you have probably found that the old 2.x versions of LXC & LXD were removed, but the installation of the new versions failed.  Not to worry, if you now run `./pde-setup --update`, the necessary changes will be made and the new versions of LXC & LXD will be installed.  Any containers you created with the old version should be updated and working.  Of course, it's preferable to run `./pde-setup --update` before performing the partial upgrade.  You can just cancel the partial upgrade and `./pde-setup --update` will take care of the rest.

As always, please report any problems by opening an issue on GitHub.