3isec template-cacher how to update?

User Support
1

I have installed the cacher via the 3isec unman RPM.

All templates can be updated.

Only the cacher itself can not update.
What do I have to consider here?

root@template-cacher:~# apt update
Err:1 https://deb.qubes-os.org/r4.1/vm bullseye InRelease
  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
Err:2 https://deb.debian.org/debian bullseye InRelease
  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
Err:3 https://deb.qubes-os.org/r4.1/vm bullseye-testing InRelease              
  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
Err:4 https://deb.debian.org/debian-security bullseye-security InRelease       
  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
Reading package lists... Done                        
E: Failed to fetch https://deb.debian.org/debian/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
E: Failed to fetch https://deb.debian.org/debian-security/dists/bullseye-security/InRelease  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
E: Failed to fetch https://deb.qubes-os.org/r4.1/vm/dists/bullseye/InRelease  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
E: Failed to fetch https://deb.qubes-os.org/r4.1/vm/dists/bullseye-testing/InRelease  Invalid response from proxy: HTTP/1.0 403 CONNECT denied (ask the admin to allow HTTPS tunnels)     [IP: 127.0.0.1 8082]
E: Some index files failed to download. They have been ignored, or old ones used instead.
2

apt-cacher-ng allows for updating of HTTPS repositories.
Rather than run a MITM (like squid), the repository definition are
rewritten as so - https:// becomes http://HTTPS///
This allows cacher to “see” the request in plain, while the request to
the server will be made by https.
This change is done automatically when you install the 3isec-cacher package.

This cant (of course) be done when you install the template for cacher
because the apt-cacher-ng proxy doesn’t exist at that time. So the
repository definitions are NOT changed. I need to find a clever way
around this.
apt-cacher-ng doesn’t know what to do with https traffic (as it is
encrypted), which is why you see the error message.

You can resolve this by changing the repository definition in
template-cacher:

sed -i s^https://^http://HTTPS///^ /etc/apt/sources.list
sed -i s^https://^http://HTTPS///^ /etc/apt/sources.list.d/qubes-r4.list

will do.

Alternatively, as explained in the Details, and in
/srv/salt/cacher/README, there’s a salt state you can apply:
sudo qubesctl --skip-dom0 --show-output --targets=template-cacher state.apply cacher.change_templates

3

Thanks for the detailed feedback, now I understand.