aptly on Ubuntu 24.04 LTS

aptly is a powerful, self hosted tool for managing Debian and Ubuntu package repositories. It lets you mirror upstream APT repositories, take point in time snapshots so your fleet always installs an identical, reproducible set of packages, and publish your own GPG signed repositories that any apt client verifies and consumes. This cloudimg image runs aptly 1.6.3 from the official upstream release binary on Ubuntu 24.04 LTS, as a hardened systemd service behind nginx.

Application stack: aptly runs its REST API bound to the loopback interface only, and nginx is the single network facing surface. nginx terminates TLS on port 443, fronts the management API with HTTP basic authentication, and serves your published repositories read only to APT clients. aptly keeps its own embedded database and package pool on disk, so there is no separate database server to run, and everything is driven by the aptly command line and REST API rather than a web console, which makes it straightforward to automate from your CI pipelines.

Security is built in with no shared credentials, since nothing secret is baked into the image. On the first boot of every instance, aptly generates a unique GPG signing key, a unique HTTP basic authentication password for the management API, and a unique self signed TLS certificate, then publishes a demonstration repository signed with that per instance key. The published public key is exported so your clients can trust the repository, the generated credentials are written to a root only file, the management API cannot be reached without the per instance password, and the published repositories are read only. Repository trust comes from GPG signatures, the standard APT security model, so serving repositories read only over HTTPS is normal and safe.

aptly is distributed under the MIT License, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the aptly project; aptly is a mark of its owner. cloudimg provides packaging, the nginx TLS front, the loopback only API with per instance basic auth, the per instance signing key and credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.