Cloudflare Mirror Infrastructure#
The AdySec CF Mirror is a Cloudflare Workers-based reverse proxy that makes official upstream package repositories accessible from within China without the latency and reliability issues that affect direct connections. Rather than syncing upstream content (which would require TB-scale storage), it acts purely as a transparent CDN layer — routing requests through Cloudflare's global edge network to the nearest node, with static content caching.
The entire proxy logic lives in a single worker.js file deployed as a Cloudflare Worker.
How It Works#
Incoming requests are matched against a path-prefix routing table inside the Worker. Each path prefix maps to an upstream origin:
| Path prefix | Upstream |
|---|---|
/system/ubuntu | archive.ubuntu.com/ubuntu |
/system/debian | ftp.debian.org/debian |
/system/kali, /system/archlinux, etc. | respective official mirrors |
/language/pypi | pypi.org/simple |
/language/npm | registry.npmjs.org |
/language/rust | static.rust-lang.org |
/container/docker-ce | download.docker.com |
/software/tailscale | pkgs.tailscale.com |
The handleRequest function iterates the prefix map and dispatches to one of four proxy helpers:
proxyRequest— generic pass-through for static/binary filesproxyHtmlRequest— fetches HTML and rewrites internalfiles.pythonhosted.orglinks so that PyPI package downloads are also transparently proxiedproxyBinaryRequest— handles the rewritten PyPI binary download URLs under/special/pypi/files/proxyTextRequest— fetches text files (e.g., Tailscale.listAPT sources) and rewrites the base URL so clients get a self-contained mirror config
The Worker runs on Cloudflare's Free Plan (100,000 requests/day, ≥10 Tbps bandwidth), sized for approximately 1,000+ daily users.
Mirrored Content#
OS Package Repositories #
Ubuntu, Debian (including security, ports, and debug variants), CentOS, Kali, Fedora, Arch Linux family (archlinux, archlinuxcn, archlinuxarm, arch4edu, bioarchlinux), openSUSE, FreeBSD, OpenBSD, Deepin, Kylin, Manjaro, GNU, OpenWRT, KaOS, FreeDOS.
Language Ecosystems #
- PyPI — index (
pypi.org/simple) + binary files (files.pythonhosted.org) via a two-stage proxy rewrite - npm —
registry.npmjs.org - Rust (crates/toolchains) —
static.rust-lang.org
Container Registries #
Dedicated subdomains act as registry proxies:
| Registry | Mirror endpoint |
|---|---|
| Docker Hub | docker.adysec.com |
| Quay | quay.adysec.com |
| GCR | gcr.adysec.com |
| k8s GCR | k8s-gcr.adysec.com |
| Kubernetes | k8s.adysec.com |
| GHCR | ghcr.adysec.com |
| Cloudsmith | cloudsmith.adysec.com |
| docker-ce packages | mirrors.adysec.com/container/docker-ce |
Usage in Practice: ARL Setup#
The ARL asset-reconnaissance tool's bare-metal setup script demonstrates the mirror in action. It rewrites the CentOS yum repos to mirrors.adysec.com/system/centos and sets pip's global index URL to mirrors.adysec.com/language/pypi before installing all Python dependencies — ensuring the full install succeeds on servers with restricted outbound access to official registries.
Key Design Notes#
- No local storage required. All content is fetched on-demand from official upstreams and cached at Cloudflare edge. This avoids the version-lag and supply-chain trust issues associated with traditional third-party mirrors.
- PyPI requires special handling. The simple index embeds absolute
files.pythonhosted.orgURLs, so the Worker must rewrite them into local paths before returning the index page. - Tailscale repo lists also embed their own base URL and require the same rewrite treatment to be usable.
- Configuration docs for each mirror are available at
mirror.adysec.com/<category>/<name>; download endpoints are atmirrors.adysec.com/<category>/<name>.