Update cache (WSUS for Linux)

WSUS keeps one copy of Windows updates on your network. The update cache does the same for Linux: machines get their packages through the Gardience server, which downloads each file once from its official source and keeps it for every other machine. A hundred servers installing a security fix download it once, and the machines need to reach only Gardience, not the internet.

It works with the official sources of Debian, Ubuntu, Rocky Linux, AlmaLinux and EPEL. Find it under Patching > Update cache (admins only).

Turn it on#

1. Check Networks that may use it. It starts as the private address ranges, so machines inside your network can use it and the internet cannot; narrow it to your machines' networks if you like.
2. Check Address machines use for updates. It starts as the address machines already use for this server; it must match a name or address on the server's certificate, and end in /updates.
3. Tick Cache on and choose Save. The change is in the audit log.

The server needs to reach the official sources over HTTPS, and checks each one's certificate. The cache uses up to 50 GB by default; root sets another size with GARDIENCE_UPDATES_CACHE_GB in the server's .env before an upgrade.

Point machines at it#

Pick machines under Linux machines and choose Use the cache. On each machine Gardience:

1. keeps a copy of each package source file it changes (/var/backups/gardience/repos-original.tar.gz),
2. points each official source at the cache, leaving every other source as it is (Docker's, a vendor's, Red Hat or SUSE subscription repositories),
3. refreshes the package lists through the cache, and puts every file back at once if that fails.

Patch as usual afterwards: tested patch sets, rings, schedules, change windows and approvals all work the same way. Check all shows, per machine, whether its updates come from this server or the internet.

Back to their own sources puts the files Gardience changed back exactly as they were. Files it never changed are not touched, and a file someone edited after Gardience changed it is left as it is and named in the result.

These two actions run only from this page, never from the command center, a runbook or the assistant.

What stays the same, and what is new#

• Packages are still checked on every machine. They stay signed by Debian, Ubuntu, Rocky, Alma or Fedora, and apt and dnf check those signatures as before. The cache cannot change a package without the machine refusing it.
• One new trust, for one address. When the server's certificate is self-signed or from your own certificate authority, machines trust it for the update address only (apt's CaInfo for that host, dnf's sslcacert for those repositories). It is never added to the machine's system certificate store.
• Indexes come over verified HTTPS. Gardience fetches every source over HTTPS and checks its certificate. Rocky, Alma and EPEL normally pick a mirror from a list (EPEL's "metalink" also checks that the index is current). Through the cache, machines use the official server instead, and Gardience checks that server's certificate. An old or altered index still cannot install anything unsigned.
• Not an open proxy. The cache fetches only package and index files from the official sources listed above (no ISO images, nothing else), answers only machines in the allowed networks, and only while it is on.
• Turning it off while machines still use it would make their updates fail, so Gardience asks you to put them back first or confirm.

Networks with no internet#

The cache can be carried into a network with no internet at all:

1. On a Gardience server with internet, turn the cache on and point a few machines at it that run the same Linux versions as the offline network. Install and patch what the offline machines need, so the cache holds it.
2. Export it (as root on that server): ./gardience updates export updates.tar.gz. A .sha256 file is written beside it.
3. Carry both files in, and on the offline server: ./gardience updates import updates.tar.gz. The checksum is checked first, and only plain files are unpacked into the cache.
4. Turn the cache on there and point the machines at it as above. They install those packages with no internet.

Packages are still checked against their publishers' signatures on every machine, so a bundle cannot slip in anything unsigned. Debian's security index expires after about a week (apt then refuses it as out of date), so bring in a fresh bundle at least weekly for Debian security updates.

Not covered#

• Red Hat Enterprise Linux and SUSE subscription repositories (they need the machine's own entitlement), Amazon Linux, and vendors' own repositories: those machines keep using their sources as they are.
• Windows: Windows machines keep getting updates from Microsoft (or your WSUS) as before.
• Packages the connected cache never fetched: an offline network gets only what was installed through the cache before the export.