Salt - caching proxy. Update config file for acng 3.7.4.

Change handling of repository lists installed by package and extra definitions. Improve handling of Fedora repositories.
2024-10-01 01:25:41 -04:00 · 2024-06-04 11:47:36 +00:00 · 2024-06-04 11:47:36 +00:00 · 0267fd7077
commit 0267fd7077
parent 97d9f5bb41
11 changed files with 223 additions and 589 deletions
--- a/cacher.spec
+++ b/cacher.spec
@ -1,6 +1,6 @@
 Name:           3isec-qubes-cacher
-Version:       	1.15
-Release:        2%{?dist}
+Version:       	1.16
+Release:        1%{?dist}
 Summary:        A caching proxy in Qubes

 License:        GPLv3+
@ -97,6 +97,10 @@ if [ $1 -eq 0 ]; then
 fi

 %changelog
+* Tue June 06 2024 unman <unman@thirdeyesecurity.org> - 1.16.1
+- Update config file for acng 3.7.4
+- Change handling of repository lists installed by package and extra definitions.
+- Improve handling of Fedora repositories.
 * Sun Mar 31 2024 unman <unman@thirdeyesecurity.org> - 1.15.2
 - Make sure that configuration is correctly prepended to policy file. 
 * Thu Feb 22 2024 unman <unman@thirdeyesecurity.org> - 1.15
--- a/cacher/50_user.conf
+++ b/cacher/50_user.conf
@ -1,2 +1,6 @@
 binds+=( '/var/cache/apt-cacher-ng' )
 binds+=( '/var/log/apt-cacher-ng' )
+binds+=( '/etc/apt-cacher-ng/acng.conf' )
+binds+=( '/etc/apt-cacher-ng/archlx_mirrors_extra' )
+binds+=( '/etc/apt-cacher-ng/debian_mirrors_extra' )
+binds+=( '/etc/apt-cacher-ng/fedora_mirrors_extra' )
--- a/cacher/acng.conf
+++ b/cacher/acng.conf
@ -11,14 +11,20 @@
 # software package downloads. It's supposed to be in a directory specified by
 # the -c option of apt-cacher-ng, see apt-cacher-ng(8) for details.
 # RULES:
-# Letter case in variable names does not matter, names and values should be
-# separated with colons. For boolean variables, zero number is considered false,
-# non-zero considered true. If a default value is not explicitly mentioned in
-# the description, the commented value assignments mostly represent the default
-# values of the particular variables.
+# - letter case in variable names does not matter
+# - names and values are separated by colon or equals sign
+# - for boolean variables, zero means false, non-zero means true
+# - "default value" means built-in (!) defaults, i.e. something which the
+#   program uses if the option is not set here or in other config files.
+#   That value might be explicitly mentioned in the description. Where it is
+#   not, there is no reason to assume any of the examples to be the default
+#   value! In doubt, use acngtool to query the value of the particular variable.

 # Storage directory for downloaded data and related maintenance activity.
 #
+# Note: When the value for CacheDir is changed, change the file
+# /lib/systemd/system/apt-cacher-ng.service too
+#
 CacheDir: /var/cache/apt-cacher-ng

 # Log file directory, can be set empty to disable logging
@ -34,6 +40,7 @@ SupportDir: /usr/lib/apt-cacher-ng
 # Can be set to 9999 to emulate apt-proxy. Value of 0 turns off TCP server
 # (SocketPath must be set in this case).
 #
+# Port:3142
 Port:8082

 # Addresses or hostnames to listen on. Multiple addresses must be separated by
@ -41,7 +48,9 @@ Port:8082
 # local interface. DNS resolution is performed using getaddrinfo(3) for all
 # available protocols (IPv4, IPv6, ...). Using a protocol specific format will
 # create binding(s) only on protocol specific socket(s), e.g. 0.0.0.0 will
-# listen only to IPv4.
+# listen only to IPv4. The endpoint can also be specified as host:port (or
+# [ipv6-address]:port) which allows binding on non-standard ports (Port
+# directive is ignored in this case).
 #
 # Default: listens on all interfaces and protocols
 #
@ -59,18 +68,19 @@ Port:8082
 # In this example, some backends files might be generated during package
 # installation using information collected on the system.
 # Examples:
-#Remap-debrep: https://deb.debian.org http://deb.debian.org  file:deb_mirrors.gz /debian ; file:backends_debian # Debian Archives
-#Remap-alxrep: file:archlx_mirrors /archlinux # ; file:backend_archlx # Arch Linux
-Remap-alxrep: file:archlx_mirrors /archlinux 
-Remap-debrep: https://deb.debian.org http://deb.debian.org  file:deb_mirrors.gz /debian 
-Remap-fedora: file:fedora_mirrors # Fedora Linux
+# Remap-alxrep: file:archlx_mirrors /archlinux 
+Remap-alxrep: file:archlx_mirrors file:archlx_mirrors_extra   /archlinux
+Remap-debrep: file:deb_mirror*.gz file:debian_mirrors_extra /debian ; file:backends_debian # Debian Archives
+Remap-fedrep: file:fedora_mirrors file:fedora_mirrors_extra ; https://mirrors.kernel.org/fedora/ https://ftp-stud.hs-esslingen.de/pub/fedora/linux/  # Fedora Linux
+
 Remap-uburep: file:ubuntu_mirrors /ubuntu ; file:backends_ubuntu # Ubuntu Archives
+Remap-klxrep: file:kali_mirrors /kali ; file:backends_kali # Kali Linux Archives
 Remap-cygwin: file:cygwin_mirrors /cygwin # ; file:backends_cygwin # incomplete, please create this file or specify preferred mirrors here
-#Remap-sfnet:  file:sfnet_mirrors # ; file:backends_sfnet # incomplete, please create this file or specify preferred mirrors here
+Remap-sfnet:  file:sfnet_mirrors # ; file:backends_sfnet # incomplete, please create this file or specify preferred mirrors here
 Remap-epel:   file:epel_mirrors # Fedora EPEL
 Remap-slrep:  file:sl_mirrors # Scientific Linux
 Remap-gentoo: file:gentoo_mirrors.gz /gentoo ; file:backends_gentoo # Gentoo Archives
-Remap-secdeb: security.debian.org ; security.debian.org deb.debian.org/debian-security
+Remap-secdeb: https://security.debian.org https://security.debian.org/debian-security https://deb.debian.org/debian-security /debian-security cdn-fastly.deb.debian.org/debian-security #; deb.debian.org/debian-security security.debian.org cdn-fastly.deb.debian.org/debian-security

 # Virtual page accessible in a web browser to see statistics and status
 # information, i.e. under http://localhost:3142/acng-report.html
@ -83,11 +93,12 @@ Remap-secdeb: security.debian.org ; security.debian.org deb.debian.org/debian-se
 ReportPage: acng-report.html

 # Socket file for accessing through local UNIX socket instead of TCP/IP. Can be
-# used with inetd (via bridge tool in.acng from apt-cacher-ng package).
+# used with inetd (via bridge tool in.acng from apt-cacher-ng package), is also
+# used internally for administrative purposes.
 #
-# Default: not set, UNIX socket bridge is disabled.
+# Default: /run/apt-cacher-ng/socket
 #
-# SocketPath:/var/run/apt-cacher-ng/socket
+# SocketPath: /var/run/apt-cacher-ng/socket

 # If set to 1, makes log files be written to disk on every new line. Default
 # is 0, buffers are flushed after the client disconnects. Technically,
@ -128,6 +139,18 @@ UnbufferLogs: 1
 #
 ExThreshold: 4

+# If set to true, the removal (i.e. response status 404) of remote
+# volatile/index files is considered a hint to consider the local cached
+# versions irrelevant and also expire them just like package files. This adds
+# some risk of removing too much cache contents in cases where a middlebox
+# reports bogus 404 codes.
+#
+# If false (0), a less sloppy algorithm is used to invalidate certain keyfiles
+# first, which might subsequently expire the cache contents but much later or
+# maybe never unless the administrator intervenes.
+#
+FollowIndexFileRemoval: 1
+
 # If the expiration is run daily, it sometimes does not make much sense to do
 # it because the expected changes (i.e. removal of expired files) don't justify
 # the extra processing time or additional downloads for expiration operation
@ -192,6 +215,17 @@ ExThreshold: 4
 # is refused when this value is reached (below zero = unlimited).
 # MaxConThreads: -1
 #
+# Timeout for a forced disconnect in cases where a client connection is about
+# to be closed but remote refuses to confirm the disconnect request. Setting
+# this to a lower value mitigates the effects of resource starvation in case of
+# a DOS attack but increases the risk of failing to flush the remaining portion
+# of data.
+# DisconnectTimeout: 15
+
+# By default, if a remote suddenly reconnects, ACNG tries at least two times to
+# redownload from the same or different location (if known).
+# DlMaxRetries: 2
+
 # Pigeonholing files (like static vs. volatile contents) is done by (extended)
 # regular expressions.
 #
@ -220,8 +254,9 @@ ExThreshold: 4
 # To see examples of the expected syntax, run: apt-cacher-ng -p debug=1
 #
 PfilePatternEx: .*yaml.gz$|.*fedora.*arch=x86_64$|.*f37&arch=x86_64|.*f38&arch=x86_64|.*f39&arch=x86_64
-# VfilePatternEx:
-VfilePatternEx: .*fedora.*updateinfo.*xml.zck$|^/\?release=[0-9]+&arch=.*|.*/RPM-GPG-KEY.*|.*\?repo=fedora|.*pkg.tar.zst.sig|.*archlinux.*sha256sums.txt|.*archlinux/iso.*tar.gz.sig
+VfilePatternEx: .*fedora.*updateinfo.*xml.zck$|^/\?release=[0-9]+&arch=.*|.*/RPM-GPG-KEY.*|.*\?repo=fedora
+#VfilePatternEx: .*fedora.*updateinfo.*xml.zck$|^/\?release=[0-9]+&arch=.*|.*/RPM-GPG-KEY.*|.*\?repo=fedora|.*pkg.tar.zst.sig|.*archlinux.*sha256sums.txt|.*archlinux/iso.*tar.gz.sig
+
 # SPfilePatternEx:
 # SVfilePatternEx:
 # WfilePatternEx:
@ -277,7 +312,14 @@ VfilePatternEx: .*fedora.*updateinfo.*xml.zck$|^/\?release=[0-9]+&arch=.*|.*/RPM

 # Network timeout for outgoing connections, in seconds.
 #
-# NetworkTimeout: 60
+# NetworkTimeout: 40
+
+# Fast fallback timeout, in seconds. This is the time to wait before
+# alternative target addresses for a client connection are tried, which can be
+# usefull for quick fallback to IPv4 in case of whacky IPv6 configuration.
+#
+# FastTimeout = 4
+FastTimeout = 6

 # Sometimes it makes sense to not store the data in cache and just return the
 # package data to client while it comes in. The following DontCache* parameters
@ -304,8 +346,8 @@ VfilePatternEx: .*fedora.*updateinfo.*xml.zck$|^/\?release=[0-9]+&arch=.*|.*/RPM
 #
 # Example:
 # DontCache: .*.local.university.int
-DontCache: .*fedora.*updates.*updateinfo.xml.zck  .*fedora.*updates.*repomd.xml
-#DontCache: .*fedora.*updates.*updateinfo.xml.zck
+# DontCache: .*fedora.*updates.*updateinfo.xml.zck  .*fedora.*repomd.xml
+

 # Default permission set of freshly created files and directories, as octal
 # numbers (see chmod(1) for details).
@ -390,7 +432,7 @@ LocalDirs: acng-doc /usr/share/doc/apt-cacher-ng
 # This restriction can be disabled by specifying a list of allowed ports or 0
 # for any port.
 #
-# AllowUserPorts: 80 443
+# AllowUserPorts: 80
 AllowUserPorts: 80 443

 # Normally the HTTP redirection responses are forwarded to the original caller
@ -408,10 +450,11 @@ AllowUserPorts: 80 443

 # There some broken HTTP servers and proxy servers in the wild which don't
 # support the If-Range header correctly and return incorrect data when the
-# contents of a (volatile) file changed. Setting VfileUseRangeOps to zero
-# disables Range-based requests while retrieving volatile files, using
-# If-Modified-Since and requesting the complete file instead. Setting it to
-# a negative value removes even If-Modified-Since headers.
+# contents of a (volatile) file changed. This also applies to incomplete
+# resumed downloads.  Setting VfileUseRangeOps to 0 disables Range-based
+# requests (using purely If-Modified-Since and requesting the complete file
+# instead, if changed). Setting it to a negative value removes even this check
+# and means fetching the whole file from the beginning.
 #
 # VfileUseRangeOps: 1
 VfileUseRangeOps: 0
@ -426,20 +469,16 @@ VfileUseRangeOps: 0
 #
 # Default: ^(bugs\.debian\.org|changelogs\.ubuntu\.com):443$
 # PassThroughPattern: ^(bugs\.debian\.org|changelogs\.ubuntu\.com):443$
-#PassThroughPattern: ^codecs\.fedoraproject\.org:443$|mirrors.rpmfusion.org:443
-PassThroughPattern: ^codecs\.fedoraproject\.org:443$

-# It's possible that an evil client requests a volatile file but does not
-# retrieve the response and keeps the connection effectively stuck over
-# many hours, blocking the particular file for other download attempts (which
-# leads to not reporting file changes on server side to other users). The work
-# around is the use of alternative file descriptors inside of apt-cacher-ng,
-# however this might cost some extra download traffic due to worse cache usage.
-# The ResponseFreezeDetectTime value specifies when a file descriptor in the
-# mentioned state is to be considered defect and will require special handling.
-# Default time is 500 seconds.
+# Interval an overaged local cache item (i.e. active file descriptor) can be
+# considered broken so that a new forced download can be started. Such
+# situation can happen when a very slow clients keeps a hot cache item active
+# for extended amounts of time so that even the remote freshness checks
+# intervals might become overrun.
 #
-# ResponseFreezeDetectTime: 500
+# Default time is based on the value of FreshIndexMaxAge with a safety factor.
+#
+# ResponseFreezeDetectTime: 60

 # Keep outgoing connections alive and reuse them for later downloads from
 # the same server as long as possible.
@ -546,3 +585,11 @@ PassThroughPattern: ^codecs\.fedoraproject\.org:443$
 # Set to zero to disable this feature completely. Default: one megabyte
 #
 # ReserveSpace: 1048576
+
+# PermitCacheControl will allow users to specify a few hints for processing
+# of a request, for example bypassing the local cache (see
+# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control for
+# no-cache, no-store).
+#
+# PermitCacheControl: no-cache, no-store
+
--- a/cacher/archlx_mirrors
+++ b/cacher/archlx_mirrors
@ -1,345 +0,0 @@
-http://arch.hu.fo/archlinux/
-http://arch.jensgutermuth.de/
-http://arch.lucassymons.net/
-http://arch.midov.pl/arch/
-http://arch.mirror.constant.com/
-http://arch.mirror.far.fi/
-http://arch.mirror.square-r00t.net/
-http://arch.mirror.zachlge.org/
-http://arch.mirrors.lavatech.top/
-http://arch.mirrors.pair.com/
-http://arch.nimukaito.net/
-http://arch.nixlab.pl/
-http://arch.opnmirror.co.za/
-http://arch.petarmaric.com/
-http://arch.serverspace.co.uk/arch/
-http://arch.softver.org.mk/archlinux/
-http://arch.yourlabs.org/
-http://archimonde.ts.si/archlinux/
-http://archlinux.c3sl.ufpr.br/
-http://archlinux.ccns.ncku.edu.tw/archlinux/
-http://archlinux.cs.nctu.edu.tw/
-http://archlinux.cu.be/
-http://archlinux.de-labrusse.fr/
-http://archlinux.dynamict.se/
-http://archlinux.grena.ge/
-http://archlinux.honkgong.info/
-http://archlinux.ip-connect.vn.ua/
-http://archlinux.iskon.hr/
-http://archlinux.koyanet.lv/archlinux/
-http://archlinux.mailtunnel.eu/
-http://archlinux.mirror.ba/
-http://archlinux.mirror.colo-serv.net/
-http://archlinux.mirror.digitalpacific.com.au/
-http://archlinux.mirror.garr.it/archlinux/
-http://archlinux.mirror.iphh.net/
-http://archlinux.mirror.kangaroot.net/
-http://archlinux.mirror.liquidtelecom.com/
-http://archlinux.mirror.liteserver.nl/
-http://archlinux.mirror.pcextreme.nl/
-http://archlinux.mirror.py/archlinux/
-http://archlinux.mirror.rafal.ca/
-http://archlinux.mirror.root.lu/
-http://archlinux.mirror.server24.net/
-http://archlinux.mirror.wearetriple.com/
-http://archlinux.mirrors.benatherton.com/
-http://archlinux.mirrors.linux.ro/
-http://archlinux.mirrors.ovh.net/archlinux/
-http://archlinux.mirrors.uk2.net/
-http://archlinux.nautile.nc/archlinux/
-http://archlinux.polymorf.fr/
-http://archlinux.pop-es.rnp.br/
-http://archlinux.rezopole.net/
-http://archlinux.surlyjake.com/archlinux/
-http://archlinux.thaller.ws/
-http://archlinux.uib.no/
-http://archlinux.uk.mirror.allworldit.com/archlinux/
-http://archlinux.za.mirror.allworldit.com/archlinux/
-http://archlinux.zepto.cloud/
-http://archmirror.hbit.sztaki.hu/archlinux/
-http://archmirror1.octyl.net/
-http://arlm.tyzoid.com/
-http://artfiles.org/archlinux.org/
-http://br.mirror.archlinux-br.org/
-http://ca.us.mirror.archlinux-br.org/
-http://dfw.mirror.rackspace.com/archlinux/
-http://distro.ibiblio.org/archlinux/
-http://f.archlinuxvn.org/archlinux/
-http://free.nchc.org.tw/arch/
-http://ftp-stud.hs-esslingen.de/pub/Mirrors/archlinux/
-http://ftp.acc.umu.se/mirror/archlinux/
-http://ftp.agdsn.de/pub/mirrors/archlinux/
-http://ftp.byfly.by/pub/archlinux/
-http://ftp.cc.uoc.gr/mirrors/linux/archlinux/
-http://ftp.energia.mta.hu/pub/mirrors/ftp.archlinux.org/
-http://ftp.fau.de/archlinux/
-http://ftp.fi.muni.cz/pub/linux/arch/
-http://ftp.gwdg.de/pub/linux/archlinux/
-http://ftp.halifax.rwth-aachen.de/archlinux/
-http://ftp.harukasan.org/archlinux/
-http://ftp.heanet.ie/mirrors/ftp.archlinux.org/
-http://ftp.hosteurope.de/mirror/ftp.archlinux.org/
-http://ftp.icm.edu.pl/pub/Linux/dist/archlinux/
-http://ftp.iinet.net.au/pub/archlinux/
-http://ftp.jaist.ac.jp/pub/Linux/ArchLinux/
-http://ftp.lanet.kr/pub/archlinux/
-http://ftp.linux.cz/pub/linux/arch/
-http://ftp.linux.org.tr/archlinux/
-http://ftp.lysator.liu.se/pub/archlinux/
-http://ftp.myrveln.se/pub/linux/archlinux/
-http://ftp.nluug.nl/os/Linux/distr/archlinux/
-http://ftp.ntua.gr/pub/linux/archlinux/
-http://ftp.osuosl.org/pub/archlinux/
-http://ftp.otenet.gr/linux/archlinux/
-http://ftp.rediris.es/mirror/archlinux/
-http://ftp.rnl.tecnico.ulisboa.pt/pub/archlinux/
-http://ftp.sh.cvut.cz/arch/
-http://ftp.snt.utwente.nl/pub/os/linux/archlinux/
-http://ftp.spline.inf.fu-berlin.de/mirrors/archlinux/
-http://ftp.sudhip.com/archlinux/
-http://ftp.swin.edu.au/archlinux/
-http://ftp.tku.edu.tw/Linux/ArchLinux/
-http://ftp.tsukuba.wide.ad.jp/Linux/archlinux/
-http://ftp.tu-chemnitz.de/pub/linux/archlinux/
-http://ftp.u-strasbg.fr/linux/distributions/archlinux/
-http://ftp.uni-bayreuth.de/linux/archlinux/
-http://ftp.uni-hannover.de/archlinux/
-http://ftp.uni-kl.de/pub/linux/archlinux/
-http://ftp.vectranet.pl/archlinux/
-http://ftp.wrz.de/pub/archlinux/
-http://ftp.yzu.edu.tw/Linux/archlinux/
-http://ftpmirror.infania.net/mirror/archlinux/
-http://glua.ua.pt/pub/archlinux/
-http://gluttony.sin.cvut.cz/arch/
-http://hkg.mirror.rackspace.com/archlinux/
-http://iad.mirror.rackspace.com/archlinux/
-http://iad.mirrors.misaka.one/archlinux/
-http://il.us.mirror.archlinux-br.org/
-http://linorg.usp.br/archlinux/
-http://linux.rz.rub.de/archlinux/
-http://lon.mirror.rackspace.com/archlinux/
-http://mir.archlinux.fr/
-http://mirroir.wptheme.fr/archlinux/
-http://mirror-archlinux.webruimtehosting.nl/
-http://mirror-hk.koddos.net/archlinux/
-http://mirror.0x.sg/archlinux/
-http://mirror.23media.com/archlinux/
-http://mirror.aktkn.sg/archlinux/
-http://mirror.ams1.nl.leaseweb.net/archlinux/
-http://mirror.anigil.com/archlinux/
-http://mirror.anquan.cl/archlinux/
-http://mirror.archlinux.cl/
-http://mirror.archlinux.ikoula.com/archlinux/
-http://mirror.archlinux.no/
-http://mirror.arctic.lol/ArchMirror/
-http://mirror.arizona.edu/archlinux/
-http://mirror.bizflycloud.vn/archlinux/
-http://mirror.bytemark.co.uk/archlinux/
-http://mirror.cc.columbia.edu/pub/linux/archlinux/
-http://mirror.cedia.org.ec/archlinux/
-http://mirror.cedille.club/archlinux/
-http://mirror.chaoticum.net/arch/
-http://mirror.checkdomain.de/archlinux/
-http://mirror.clientvps.com/archlinux/
-http://mirror.cs.pitt.edu/archlinux/
-http://mirror.cs.vt.edu/pub/ArchLinux/
-http://mirror.csclub.uwaterloo.ca/archlinux/
-http://mirror.cse.iitk.ac.in/archlinux/
-http://mirror.cspacehostings.com/archlinux/
-http://mirror.cyberbits.eu/archlinux/
-http://mirror.dal10.us.leaseweb.net/archlinux/
-http://mirror.datacenter.by/pub/archlinux/
-http://mirror.digitalnova.at/archlinux/
-http://mirror.dkm.cz/archlinux/
-http://mirror.easylee.nl/archlinux/
-http://mirror.easyname.at/archlinux/
-http://mirror.efect.ro/archlinux/
-http://mirror.es.its.nyu.edu/archlinux/
-http://mirror.espoch.edu.ec/archlinux/
-http://mirror.ette.biz/archlinux/
-http://mirror.f4st.host/archlinux/
-http://mirror.faizuladib.com/archlinux/
-http://mirror.fra10.de.leaseweb.net/archlinux/
-http://mirror.fsmg.org.nz/archlinux/
-http://mirror.fsrv.services/archlinux/
-http://mirror.gi.co.id/archlinux/
-http://mirror.guillaumea.fr/archlinux/
-http://mirror.hackingand.coffee/arch/
-http://mirror.host.ag/archlinux/
-http://mirror.hoster.kz/archlinux/
-http://mirror.hosthink.net/archlinux/
-http://mirror.i3d.net/pub/archlinux/
-http://mirror.ibcp.fr/pub/archlinux/
-http://mirror.ihost.md/archlinux/
-http://mirror.init7.net/archlinux/
-http://mirror.internode.on.net/pub/archlinux/
-http://mirror.is.co.za/mirror/archlinux.org/
-http://mirror.isoc.org.il/pub/archlinux/
-http://mirror.its.dal.ca/archlinux/
-http://mirror.juniorjpdj.pl/archlinux/
-http://mirror.kaminski.io/archlinux/
-http://mirror.kku.ac.th/archlinux/
-http://mirror.koddos.net/archlinux/
-http://mirror.kumi.systems/archlinux/
-http://mirror.labkom.id/archlinux/
-http://mirror.lagoon.nc/pub/archlinux/
-http://mirror.lastmikoi.net/archlinux/
-http://mirror.launtel.net.au/repo/arch/
-http://mirror.librelabucm.org/archlinux/
-http://mirror.lnx.sk/pub/linux/archlinux/
-http://mirror.lty.me/archlinux/
-http://mirror.lyrahosting.com/archlinux/
-http://mirror.lzu.edu.cn/archlinux/
-http://mirror.math.princeton.edu/pub/archlinux/
-http://mirror.metalgamer.eu/archlinux/
-http://mirror.metrocast.net/archlinux/
-http://mirror.mia11.us.leaseweb.net/archlinux/
-http://mirror.mijn.host/archlinux/
-http://mirror.mikrogravitation.org/archlinux/
-http://mirror.mirohost.net/archlinux/
-http://mirror.nak-mci.ir/arch/
-http://mirror.neostrada.nl/archlinux/
-http://mirror.netcologne.de/archlinux/
-http://mirror.netweaver.uk/archlinux/
-http://mirror.neuf.no/archlinux/
-http://mirror.nus.edu.sg/archlinux/
-http://mirror.oldsql.cc/archlinux/
-http://mirror.one.com/archlinux/
-http://mirror.onet.pl/pub/mirrors/archlinux/
-http://mirror.onevip.mk/archlinux/
-http://mirror.orbit-os.com/archlinux/
-http://mirror.papua.go.id/archlinux/
-http://mirror.pit.teraswitch.com/archlinux/
-http://mirror.pmf.kg.ac.rs/archlinux/
-http://mirror.poliwangi.ac.id/archlinux/
-http://mirror.premi.st/archlinux/
-http://mirror.ps.kz/archlinux/
-http://mirror.pseudoform.org/
-http://mirror.puzzle.ch/archlinux/
-http://mirror.rackspace.com/archlinux/
-http://mirror.rasanegar.com/archlinux/
-http://mirror.redrock.team/archlinux/
-http://mirror.reisenbauer.ee/archlinux/
-http://mirror.rise.ph/archlinux/
-http://mirror.rol.ru/archlinux/
-http://mirror.satis-faction.de/archlinux/
-http://mirror.scd31.com/arch/
-http://mirror.selfnet.de/archlinux/
-http://mirror.sergal.org/archlinux/
-http://mirror.serverion.com/archlinux/
-http://mirror.sfinae.tech/pub/mirrors/archlinux/
-http://mirror.sfo12.us.leaseweb.net/archlinux/
-http://mirror.siena.edu/archlinux/
-http://mirror.smith.geek.nz/archlinux/
-http://mirror.stephen304.com/archlinux/
-http://mirror.surf/archlinux/
-http://mirror.system.is/arch/
-http://mirror.t-home.mk/archlinux/
-http://mirror.tarellia.net/distr/archlinux/
-http://mirror.telepoint.bg/archlinux/
-http://mirror.telkomuniversity.ac.id/archlinux/
-http://mirror.terrahost.no/linux/archlinux/
-http://mirror.tiguinet.net/arch/
-http://mirror.truenetwork.ru/archlinux/
-http://mirror.ubrco.de/archlinux/
-http://mirror.ufam.edu.br/archlinux/
-http://mirror.ufro.cl/archlinux/
-http://mirror.ufscar.br/archlinux/
-http://mirror.umd.edu/archlinux/
-http://mirror.undisclose.de/archlinux/
-http://mirror.united-gameserver.de/archlinux/
-http://mirror.uta.edu.ec/archlinux/
-http://mirror.veriteknik.net.tr/archlinux/
-http://mirror.vpsfree.cz/archlinux/
-http://mirror.vtti.vt.edu/archlinux/
-http://mirror.wdc1.us.leaseweb.net/archlinux/
-http://mirror.wtnet.de/arch/
-http://mirror.wuki.li/archlinux/
-http://mirror.xeonbd.com/archlinux/
-http://mirror.xtom.com.hk/archlinux/
-http://mirror.yandex.ru/archlinux/
-http://mirror1.cl.netactuate.com/archlinux/
-http://mirror2.evolution-host.com/archlinux/
-http://mirror2.totbb.net/archlinux/
-http://mirrors.163.com/archlinux/
-http://mirrors.acm.wpi.edu/archlinux/
-http://mirrors.advancedhosters.com/archlinux/
-http://mirrors.aggregate.org/archlinux/
-http://mirrors.atviras.lt/archlinux/
-http://mirrors.bfsu.edu.cn/archlinux/
-http://mirrors.cat.net/archlinux/
-http://mirrors.cat.pdx.edu/archlinux/
-http://mirrors.celianvdb.fr/archlinux/
-http://mirrors.chroot.ro/archlinux/
-http://mirrors.cqu.edu.cn/archlinux/
-http://mirrors.dgut.edu.cn/archlinux/
-http://mirrors.dotsrc.org/archlinux/
-http://mirrors.evowise.com/archlinux/
-http://mirrors.gethosted.online/archlinux/
-http://mirrors.gigenet.com/archlinux/
-http://mirrors.go.ro/archlinux/
-http://mirrors.hit.edu.cn/archlinux/
-http://mirrors.hostico.ro/archlinux/
-http://mirrors.ims.nksc.lt/archlinux/
-http://mirrors.kernel.org/archlinux/
-http://mirrors.liquidweb.com/archlinux/
-http://mirrors.lug.mtu.edu/archlinux/
-http://mirrors.m247.ro/archlinux/
-http://mirrors.manchester.m247.com/arch-linux/
-http://mirrors.melbourne.co.uk/archlinux/
-http://mirrors.mit.edu/archlinux/
-http://mirrors.myaegean.gr/linux/archlinux/
-http://mirrors.n-ix.net/archlinux/
-http://mirrors.nav.ro/archlinux/
-http://mirrors.netix.net/archlinux/
-http://mirrors.neusoft.edu.cn/archlinux/
-http://mirrors.nic.cz/archlinux/
-http://mirrors.nix.org.ua/linux/archlinux/
-http://mirrors.niyawe.de/archlinux/
-http://mirrors.nju.edu.cn/archlinux/
-http://mirrors.nxthost.com/archlinux/
-http://mirrors.ocf.berkeley.edu/archlinux/
-http://mirrors.piconets.webwerks.in/archlinux-mirror/
-http://mirrors.pidginhost.com/arch/
-http://mirrors.powernet.com.ru/archlinux/
-http://mirrors.prometeus.net/archlinux/
-http://mirrors.rit.edu/archlinux/
-http://mirrors.rutgers.edu/archlinux/
-http://mirrors.sonic.net/archlinux/
-http://mirrors.standaloneinstaller.com/archlinux/
-http://mirrors.tuna.tsinghua.edu.cn/archlinux/
-http://mirrors.udenar.edu.co/archlinux/
-http://mirrors.ukfast.co.uk/sites/archlinux.org/
-http://mirrors.uni-plovdiv.net/archlinux/
-http://mirrors.urbanwave.co.za/archlinux/
-http://mirrors.ustc.edu.cn/archlinux/
-http://mirrors.xmission.com/archlinux/
-http://mirrors.xtom.com/archlinux/
-http://mirrors.xtom.nl/archlinux/
-http://mirrors.zju.edu.cn/archlinux/
-http://muug.ca/mirror/archlinux/
-http://nova.quantum-mirror.hu/mirrors/pub/archlinux/
-http://ord.mirror.rackspace.com/archlinux/
-http://packages.oth-regensburg.de/archlinux/
-http://phinau.de/arch/
-http://piotrkosoft.net/pub/mirrors/ftp.archlinux.org/
-http://pkg.adfinis.com/archlinux/
-http://plug-mirror.rcac.purdue.edu/archlinux/
-http://quantum-mirror.hu/mirrors/pub/archlinux/
-http://repo.ialab.dsu.edu/archlinux/
-http://repo.inara.pk/archlinux/
-http://repo.iut.ac.ir/repo/archlinux/
-http://repo.miserver.it.umich.edu/archlinux/
-http://shadow.ind.ntou.edu.tw/archlinux/
-http://sharing.thelinuxsect.com/archlinux/
-http://super.quantum-mirror.hu/mirrors/pub/archlinux/
-http://suro.ubaya.ac.id/archlinux/
-http://syd.mirror.rackspace.com/archlinux/
-http://tedwall.se/archlinux/
-http://tux.rainside.sk/archlinux/
-http://vpsmurah.jagoanhosting.com/archlinux/
-http://www.caco.ic.unicamp.br/archlinux/
-http://www.gtlib.gatech.edu/pub/archlinux/
-http://www.gutscheindrache.com/mirror/archlinux/
-http://www.mirrorservice.org/sites/ftp.archlinux.org/
-http://za.mirror.archlinux-br.org/
--- a/cacher/archlx_mirrors_extra
+++ b/cacher/archlx_mirrors_extra
@ -0,0 +1 @@
+https://mirror.osbeck.com/archlinux/
--- a/cacher/change_templates.sls
+++ b/cacher/change_templates.sls
@ -36,6 +36,12 @@
      - backup: False

 {% elif grains['os_family']|lower == 'redhat' %}
+
+stop_zchunk:
+  file.append:
+    - name: /etc/dnf/dnf.conf
+    - text: zchunk=False
+
 {% for repo in salt['file.find']('/etc/yum.repos.d/', name='*repo*') %}
 {{ repo }}_baseurl:
    file.replace:
@ -58,7 +64,6 @@
    file.uncomment:
      - name: {{ repo }}
      - regex : '.*baseurl(.*)'
-      - ignore_missing: True
      - backup: False
 {{ repo }}_comment:
    file.comment:
--- a/cacher/debian_mirrors_extra
+++ b/cacher/debian_mirrors_extra
@ -0,0 +1 @@
+https://deb.debian.org/debian/
--- a/cacher/fedora_mirrors
+++ b/cacher/fedora_mirrors
@ -1,195 +0,0 @@
-http://archive.linux.duke.edu/pub/fedora/linux/
-http://ask4.mm.fcix.net/fedora/linux/
-http://b4sh.mm.fcix.net/fedora/linux/
-http://creeperhost.mm.fcix.net/fedora/linux/
-http://distrib-coffee.ipsl.jussieu.fr/pub/linux/fedora/linux/
-http://divergentnetworks.mm.fcix.net/fedora/linux/
-http://download-cc-rdu01.fedoraproject.org/pub/fedora/linux/
-http://download-ib01.fedoraproject.org/pub/fedora/linux
-http://download-ib01.fedoraproject.org/pub/fedora/linux/
-http://download.fedoraproject.org/pub/fedora/linux/
-http://fedora-archive.ip-connect.info/fedora/linux/
-http://fedora-mirror01.rbc.ru/pub/fedora/linux/
-http://fedora-mirror02.rbc.ru/pub/fedora/linux/
-http://fedora.blizoo.mk/fedora/linux/
-http://fedora.cu.be/linux/
-http://fedora.ip-connect.info/linux/
-http://fedora.ip-connect.vn.ua/linux/
-http://fedora.ipacct.com/fedora/linux/
-http://fedora.is.co.za/linux/
-http://fedora.mirror.angkasa.id/pub/fedora/linux/
-http://fedora.mirror.constant.com
-http://fedora.mirror.digitalpacific.com.au/linux/
-http://fedora.mirror.iweb.com/linux/
-http://fedora.mirror.liteserver.nl/
-http://fedora.mirror.root.lu/
-http://fedora.mirror.tn/pub/fedora/linux/
-http://fedora.mirror.wearetriple.com/linux/
-http://fedora.mirrors.pair.com/linux/
-http://fedora.mirrors.telekom.ro/pub/fedora/linux/
-http://fedora.tu-chemnitz.de/pub/linux/fedora/linux/
-http://forksystems.mm.fcix.net/fedora/linux/
-http://fr2.rpmfind.net/linux/fedora/linux/
-http://free.nchc.org.tw/fedora/linux/
-http://ftp-chi.osuosl.org/pub/fedora/linux
-http://ftp-chi.osuosl.org/pub/fedora/linux/
-http://ftp-stud.hs-esslingen.de/pub/Mirrors/archive.fedoraproject.org/fedora/linux/
-http://ftp-stud.hs-esslingen.de/pub/fedora/linux/
-http://ftp.acc.umu.se/mirror/fedora/linux/
-http://ftp.byfly.by/pub/fedoraproject.org/linux/
-http://ftp.cc.uoc.gr/pub/linux/fedora/linux/
-http://ftp.cica.es/fedora/linux/
-http://ftp.colocall.net/pub/fedora/linux/
-http://ftp.cse.buffalo.edu/pub/fedora/linux/
-http://ftp.fau.de/fedora/linux/
-http://ftp.fi.muni.cz/pub/linux/fedora/linux/
-http://ftp.halifax.rwth-aachen.de/fedora/linux/
-http://ftp.icm.edu.pl/pub/Linux/fedora/linux/
-http://ftp.iij.ad.jp/pub/linux/Fedora/fedora/linux/
-http://ftp.ines.lug.ro/fedora/linux/
-http://ftp.jaist.ac.jp/pub/Linux/Fedora/
-http://ftp.linux.cz/pub/linux/fedora/linux/
-http://ftp.linux.org.tr
-http://ftp.lip6.fr/ftp/pub/linux/distributions/fedora/
-http://ftp.lysator.liu.se/pub/fedora/linux/
-http://ftp.nluug.nl/pub/os/Linux/distr/fedora/linux/
-http://ftp.ntua.gr/pub/linux/fedora/linux/
-http://ftp.otenet.gr/linux/fedora/linux/
-http://ftp.plusline.net/fedora/linux/
-http://ftp.tsukuba.wide.ad.jp/Linux/fedora/linux/
-http://ftp.tudelft.nl/download.fedora.redhat.com/linux/
-http://ftp.uma.es/mirror/fedora/linux/
-http://ftp.uni-bayreuth.de/linux/fedora/linux/
-http://ftp.uni-kl.de/pub/linux/fedora/linux/
-http://ftp.uni-stuttgart.de/epel/
-http://ftp.upjs.sk/pub/fedora/linux/
-http://ftp.yz.yamagata-u.ac.jp/pub/linux/fedora-projects/fedora/linux/
-http://ftp.yzu.edu.tw/Linux/Fedora/linux/
-http://kdeforge2.unl.edu/mirrors/fedora/linux/
-http://level66.mm.fcix.net/fedora/linux/
-http://linux.mirrors.es.net/fedora/
-http://mirror.1000mbps.com/fedora/linux/
-http://mirror.23m.com/fedora/linux/
-http://mirror.23media.de/fedora/linux/
-http://mirror.aarnet.edu.au/pub/fedora/linux/
-http://mirror.accum.se/mirror/fedora/linux/
-http://mirror.bytemark.co.uk/fedora/epel/
-http://mirror.bytemark.co.uk/fedora/linux/
-http://mirror.cedia.org.ec/fedora/linux/
-http://mirror.chpc.utah.edu/pub/fedora/linux/
-http://mirror.clarkson.edu/fedora/linux/
-http://mirror.cogentco.com/pub/linux/fedora/linux/
-http://mirror.cs.pitt.edu/fedora/linux/
-http://mirror.cs.princeton.edu/pub/mirrors/fedora/linux/
-http://mirror.csclub.uwaterloo.ca/fedora/linux/
-http://mirror.datacenter.by/pub/fedoraproject.org/linux/
-http://mirror.de.leaseweb.net/fedora/linux/
-http://mirror.dogado.de/fedora/linux/
-http://mirror.dst.ca/fedora-linux/fedora/linux/
-http://mirror.easyspeedy.com/fedora/
-http://mirror.epn.edu.ec/fedora/linux/
-http://mirror.etf.bg.ac.rs/fedora/
-http://mirror.euserv.net/linux/fedora/linux/
-http://mirror.fcix.net/fedora/linux/
-http://mirror.globo.com/fedora/linux/
-http://mirror.i3d.net/pub/fedora/linux/
-http://mirror.ihost.md/fedora/
-http://mirror.in2p3.fr/pub/fedora/linux/
-http://mirror.infonline.de/fedora/linux/
-http://mirror.init7.net/fedora/fedora/linux/
-http://mirror.it4i.cz
-http://mirror.its.dal.ca/pub/fedora/linux/
-http://mirror.karneval.cz/pub/linux/fedora/linux/
-http://mirror.lagoon.nc/pub/fedora/linux/
-http://mirror.library.ucy.ac.cy/linux/fedora/linux/
-http://mirror.linux-ia64.org/fedora/fedora/linux/
-http://mirror.linux-ia64.org/fedora/fedora/linux/
-http://mirror.linux-ia64.org/fedora/linux/
-http://mirror.math.princeton.edu/pub/fedora/linux/
-http://mirror.metrocast.net/fedora/linux/
-http://mirror.mrjester.net/fedora/linux/
-http://mirror.netcologne.de/fedora/linux/
-http://mirror.netsite.dk/fedora/linux/
-http://mirror.netzwerge.de/fedora/linux/
-http://mirror.nexcess.net/fedora/
-http://mirror.nl.leaseweb.net/fedora/linux/
-http://mirror.nonstop.co.il/fedora/linux/
-http://mirror.onet.pl/pub/mirrors/fedora/linux/
-http://mirror.optus.net/fedora/linux/
-http://mirror.pmf.kg.ac.rs/fedora/linux/
-http://mirror.pnl.gov/fedora/linux/
-http://mirror.prgmr.com/pub/fedora/linux/
-http://mirror.realcompute.io/fedora/linux/
-http://mirror.rise.ph/fedora/linux/
-http://mirror.rnet.missouri.edu/fedora/linux/
-http://mirror.seas.harvard.edu/fedora/linux/
-http://mirror.serverion.com/fedora/linux
-http://mirror.serverion.com/fedora/linux
-http://mirror.sfo12.us.leaseweb.net/fedora/linux/
-http://mirror.siena.edu/fedora/linux/
-http://mirror.slu.cz/fedora/linux/
-http://mirror.smartmedia.net.id/fedora/linux/
-http://mirror.steadfast.net/fedora/
-http://mirror.steadfastnet.com/epel/
-http://mirror.stjschools.org/fedora/linux/
-http://mirror.switch.ch/ftp/mirror/fedora/linux/
-http://mirror.szerverem.hu/fedora/linux/
-http://mirror.telepoint.bg/fedora/
-http://mirror.umd.edu/fedora/linux/
-http://mirror.upb.edu.co/fedora/linux/
-http://mirror.us.leaseweb.net/fedora/linux/
-http://mirror.usi.edu/pub/fedora/linux/
-http://mirror.uta.edu.ec/fedora/linux/
-http://mirror.utexas.edu/fedora/linux/
-http://mirror.uv.es/mirror/fedora/linux/
-http://mirror.veriteknik.net.tr/fedora/linux/
-http://mirror.vorboss.net/fedora/linux/
-http://mirror.vpsnet.com/fedora/linux/
-http://mirror.vutbr.cz/fedora/
-http://mirror.xenyth.net/fedora/linux/
-http://mirror.yandex.ru/fedora/linux/
-http://mirror2.totbb.net/fedora/linux/
-http://mirroronet.pl/pub/mirrors/fedora/linux/
-http://mirrors.cat.pdx.edu/fedora/linux/
-http://mirrors.dotsrc.org/fedora/linux
-http://mirrors.dotsrc.org/fedora/linux
-http://mirrors.dotsrc.org/fedora/linux/
-http://mirrors.fedoraproject.org
-http://mirrors.fedoraproject.org/fedora/linux
-http://mirrors.fedoraproject.org/fedora/linux
-http://mirrors.ircam.fr/pub/fedora/linux/
-http://mirrors.kernel.org/fedora/
-http://mirrors.lug.mtu.edu/fedora/linux/
-http://mirrors.mit.edu/fedora/linux/
-http://mirrors.n-ix.net/fedora/linux/
-http://mirrors.nav.ro/fedora/linux/
-http://mirrors.netix.net/fedora/linux/
-http://mirrors.nic.cz/fedora/linux/
-http://mirrors.rit.edu/fedora/fedora/linux
-http://mirrors.rit.edu/fedora/fedora/linux/
-http://mirrors.syringanetworks.net/fedora/linux/
-http://mirrors.uni-ruse.bg/fedora/linux/
-http://mirrors.xmission.com/fedora/linux/
-http://mirrors.xtom.de/fedora/
-http://mirrors.xtom.ee/fedora/linux
-http://mirrors.xtom.ee/fedora/linux
-http://muug.ca/mirror/fedora/linux/
-http://nnenix.mm.fcix.net/fedora/linux
-http://nnenix.mm.fcix.net/fedora/linux
-http://nocix.mm.fcix.net/fedora/linux/
-http://opencolo.mm.fcix.net/fedora/linux/
-http://opensource.nchc.org.tw/fedora/linux/
-http://pubmirror1.math.uh.edu/fedora-buffet/fedora/linux/
-http://pubmirror2.math.uh.edu/fedora-buffet/fedora/linux/
-http://repo.fedora.md/fedora/linux/
-http://southfront.mm.fcix.net/fedora/linux/
-http://ucmirror.canterbury.ac.nz/linux/fedora/linux/
-http://uvermont.mm.fcix.net/fedora/linux
-http://uvermont.mm.fcix.net/fedora/linux
-http://veronanetworks.mm.fcix.net/fedora/linux/
-http://vesta.informatik.rwth-aachen.de/ftp/pub/Linux/fedora/linux/
-http://volico.mm.fcix.net/fedora/linux
-http://www.fedora.is/fedora/
-http://www.mirrorservice.org/sites/dl.fedoraproject.org/pub/fedora/linux/
-http://www.nic.funet.fi/pub/mirrors/fedora.redhat.com/pub/fedora/linux/
-http://ziply.mm.fcix.net/fedora/linux/
--- a/cacher/fedora_mirrors_extra
+++ b/cacher/fedora_mirrors_extra
@ -0,0 +1,96 @@
+http://mirror.ox.ac.uk/sites/download.fedora.redhat.com/pub/fedora/linux
+http://ask4.mm.fcix.net/fedora/linux/
+http://b4sh.mm.fcix.net/fedora/linux/
+http://creeperhost.mm.fcix.net/fedora/linux/
+http://distrib-coffee.ipsl.jussieu.fr/pub/linux/fedora/linux/
+http://divergentnetworks.mm.fcix.net/fedora/linux/
+http://download-ib01.fedoraproject.org/pub/fedora/linux
+http://download-ib01.fedoraproject.org/pub/fedora/linux/
+http://fedora-archive.ip-connect.info/fedora/linux/
+http://fedora-mirror01.rbc.ru/pub/fedora/linux/
+http://fedora.blizoo.mk/fedora/linux/
+http://fedora.ip-connect.info/linux/
+http://fedora.ip-connect.vn.ua/linux/
+http://fedora.mirror.constant.com
+http://fedora.mirror.liteserver.nl/
+http://fedora.mirror.tn/pub/fedora/linux/
+http://fedora.mirror.wearetriple.com/linux/
+http://fedora.mirrors.pair.com/linux/
+http://forksystems.mm.fcix.net/fedora/linux/
+http://ftp-chi.osuosl.org/pub/fedora/linux
+http://ftp-chi.osuosl.org/pub/fedora/linux/
+http://ftp-stud.hs-esslingen.de/pub/Mirrors/archive.fedoraproject.org/fedora/linux/
+http://ftp.byfly.by/pub/fedoraproject.org/linux/
+http://ftp.colocall.net/pub/fedora/linux/
+http://ftp.ines.lug.ro/fedora/linux/
+http://ftp.linux.org.tr
+http://ftp.ntua.gr/pub/linux/fedora/linux/
+http://ftp.otenet.gr/linux/fedora/linux/
+http://ftp.tsukuba.wide.ad.jp/Linux/fedora/linux/
+http://ftp.tudelft.nl/download.fedora.redhat.com/linux/
+http://ftp.yzu.edu.tw/Linux/Fedora/linux/
+http://kdeforge2.unl.edu/mirrors/fedora/linux/
+http://level66.mm.fcix.net/fedora/linux/
+http://mirror.1000mbps.com/fedora/linux/
+http://mirror.23media.de/fedora/linux/
+http://mirror.accum.se/mirror/fedora/linux/
+http://mirror.bahnhof.net/fedora/linux/
+http://mirror.bytemark.co.uk/fedora/epel/
+http://mirror.clarkson.edu/fedora/linux/
+http://mirror.cogentco.com/pub/linux/fedora/linux/
+http://mirror.cs.princeton.edu/pub/mirrors/fedora/linux/
+http://mirror.dst.ca/fedora-linux/fedora/linux/
+http://mirror.epn.edu.ec/fedora/linux/
+http://mirror.etf.bg.ac.rs/fedora/
+http://mirror.euserv.net/linux/fedora/linux/
+http://mirror.fcix.net/fedora/linux/
+http://mirror.globo.com/fedora/linux/
+http://mirror.ihost.md/fedora/
+http://mirror.it4i.cz
+http://mirror.lagoon.nc/pub/fedora/linux/
+http://mirror.library.ucy.ac.cy/linux/fedora/linux/
+http://mirror.linux-ia64.org/fedora/fedora/linux/
+http://mirror.math.princeton.edu/pub/fedora/linux/
+http://mirror.mrjester.net/fedora/linux/
+http://mirror.netcologne.de/fedora/linux/
+http://mirror.onet.pl/pub/mirrors/fedora/linux/
+http://mirror.pmf.kg.ac.rs/fedora/linux/
+http://mirror.pnl.gov/fedora/linux/
+http://mirror.seas.harvard.edu/fedora/linux/
+http://mirror.serverion.com/fedora/linux
+http://mirror.smartmedia.net.id/fedora/linux/
+http://mirror.stjschools.org/fedora/linux/
+http://mirror.switch.ch/ftp/mirror/fedora/linux/
+http://mirror.telepoint.bg/fedora/
+http://mirror.upb.edu.co/fedora/linux/
+http://mirror.us.leaseweb.net/fedora/linux/
+http://mirror.usi.edu/pub/fedora/linux/
+http://mirror.uta.edu.ec/fedora/linux/
+http://mirror.utexas.edu/fedora/linux/
+http://mirror.veriteknik.net.tr/fedora/linux/
+http://mirror.vorboss.net/fedora/linux/
+http://mirror.vutbr.cz/fedora/
+http://mirror.xenyth.net/fedora/linux/
+http://mirroronet.pl/pub/mirrors/fedora/linux/
+http://mirrors.cat.pdx.edu/fedora/linux/
+http://mirrors.dotsrc.org/fedora/linux
+http://mirrors.dotsrc.org/fedora/linux/
+http://mirrors.fedoraproject.org
+http://mirrors.fedoraproject.org/fedora/linux
+http://mirrors.netix.net/fedora/linux/
+http://mirrors.nic.cz/fedora/linux/
+http://mirrors.rit.edu/fedora/fedora/linux
+http://mirrors.rit.edu/fedora/fedora/linux/
+http://mirrors.uni-ruse.bg/fedora/linux/
+http://mirrors.xtom.de/fedora/
+http://mirrors.xtom.ee/fedora/linux
+http://nnenix.mm.fcix.net/fedora/linux
+http://nocix.mm.fcix.net/fedora/linux/
+http://opencolo.mm.fcix.net/fedora/linux/
+http://southfront.mm.fcix.net/fedora/linux/
+http://uvermont.mm.fcix.net/fedora/linux
+http://veronanetworks.mm.fcix.net/fedora/linux/
+http://vesta.informatik.rwth-aachen.de/ftp/pub/Linux/fedora/linux/
+http://volico.mm.fcix.net/fedora/linux
+http://www.fedora.is/fedora/
+http://ziply.mm.fcix.net/fedora/linux/
--- a/cacher/install.sls
+++ b/cacher/install.sls
@ -21,19 +21,27 @@ installed:
      - anacron 
      - apt-cacher-ng 

-tinyproxy-disable:
+disable-tinyproxy:
  cmd.run:
    - name: systemctl disable tinyproxy

-tinyproxy-mask:
+mask-tinyproxy:
  cmd.run:
    - name: systemctl mask tinyproxy

-systemd-disable:
+disable-qubes-proxy:
+  cmd.run:
+    - name: systemctl disable qubes-updates-proxy
+
+mask-qubes-proxy:
+  cmd.run:
+    - name: systemctl mask qubes-updates-proxy
+
+disable-apt-cacher:
  cmd.run:
    - name: systemctl disable apt-cacher-ng

-systemd-mask:
+mask-apt-cacher:
  cmd.run:
    - name: systemctl mask apt-cacher-ng

--- a/cacher/mirrors.sls
+++ b/cacher/mirrors.sls
@ -5,18 +5,26 @@

 {% if grains['nodename'] != 'dom0' %}

-/etc/apt-cacher-ng/fedora_mirrors:
+/etc/apt-cacher-ng/fedora_mirrors_extra:
  file.managed:
    - source:
-      - salt://cacher/fedora_mirrors
+      - salt://cacher/fedora_mirrors_extra
    - user: root
    - group: root
    - makedirs: True

-/etc/apt-cacher-ng/archlx_mirrors:
+/etc/apt-cacher-ng/archlx_mirrors_extra:
  file.managed:
    - source:
-      - salt://cacher/archlx_mirrors
+      - salt://cacher/archlx_mirrors_extra
+    - user: root
+    - group: root
+    - makedirs: True
+
+/etc/apt-cacher-ng/debian_mirrors_extra:
+  file.managed:
+    - source:
+      - salt://cacher/debian_mirrors_extra
    - user: root
    - group: root
    - makedirs: True