Your Own Linux Mirror (Literally) on Cloudflare's Free Tier

If you've ever wanted to host a Linux package mirror but didn't want to pay for a VPS or deal with bandwidth bills, here's a thought: what if you could run it on Cloudflare Workers' free tier? And no, this isn't a hack or some edge-case trick. It's a real, working project that does exactly that.

I came across cf-mirror recently, and it's one of those things that makes you go "wait, that's actually brilliant." It turns a Cloudflare Worker into a caching reverse proxy for Linux distribution mirrors, and it handles a surprising amount of traffic before you ever hit a paywall.

What It Does

cf-mirror is a Cloudflare Worker script that acts as a caching proxy for Linux mirror repositories. You point your package manager (like apt or yum) at your Worker URL, and it fetches packages from upstream mirrors, caches them in Cloudflare's edge network, and serves them back to you.

The clever part? It uses Cloudflare's Cache API and the free tier's 100,000 requests per day limit. For a personal mirror or a small team, that's a lot of bandwidth you're not paying for.

Under the hood, it:

• Fetches files from a configured upstream mirror (like deb.debian.org or archive.ubuntu.com)
• Caches responses at the edge using Cloudflare's cache
• Handles cache invalidation for metadata files (like Packages.gz or Release) that change frequently
• Supports path-based routing, so you can serve multiple distros from a single Worker

The codebase is small, readable, and doesn't try to be clever for the sake of it. You can read the whole thing in a few minutes.

Why It’s Cool

Here's the thing: most people think of Cloudflare Workers as "serverless functions for APIs." This project shows that with a bit of creativity, you can use them for heavy lifting, like serving static binaries that repositories throw at you.

A few things stand out:

1. The cache strategy is actually smart.
It doesn't just cache everything blindly. It distinguishes between metadata files (which have short TTLs and need frequent updates) and package files (which are immutable and can be cached for ages). This is the kind of nuance that separates a toy from a tool.

2. It's genuinely useful.
I know people who run Raspberry Pi clusters or homelabs with multiple machines. Instead of every machine hitting the public mirror and slowing down your LAN, you set this up once, and all your machines pull from the Worker. You're essentially offloading your bandwidth usage to Cloudflare's edge.

3. It's a gateway to more.
Once you understand how this works, you start thinking: why not proxy other static content? It's a great reference for anyone who wants to learn how to build a caching layer on Workers without using a heavyweight framework.

4. Free tier is genuinely enough.
100k requests a day sounds like a lot, but for most personal use cases, it's actually overkill. If you're pulling packages for 5 machines, you'd have to work hard to hit that limit.

How to Try It

Getting started is straightforward:

1. Clone the repo:
   git clone https://github.com/adysec/cf-mirror
2. Read the wrangler.toml file and adjust the upstream mirror settings.
3. Deploy with wrangler publish (make sure you have Wrangler installed and logged in).
4. Point a custom domain at it (optional but recommended, since Workers have a .workers.dev subdomain that can get rate-limited).
5. Configure your package manager. For apt, that means adding a line to your sources.list like:
   deb https://your-worker.example.com/debian/ bookworm main

The README has clear instructions for Debian/Ubuntu and RHEL-based distros. No need to patch anything or hack around package manager quirks. It just works.

Final Thoughts

This project isn't going to replace the official mirrors for your whole university. But for a homelab, a small team, or just to play around, it's a perfect example of what you can do when you stop thinking about serverless as "just for APIs."

It's also refreshing to see a project that's simple enough to understand in one sitting but has real-world use. No over-engineering, no 20-step deployment process, no hidden costs. Just a smart Worker script and a good idea.

If you're already on Cloudflare's free tier, there's no reason not to try it. Worst case, you learn something about caching. Best case, you never think about apt-get being slow again.

Found this useful? Follow @githubprojects for more developer tools and side projects.