Proxmox updates US based repos

[yaboc]

Hi,

I've searched the forum for this topic and didn't see any hits. I want to deploy proxmox hopefully a cluster with ceph however our dilemma is that we do not allow connection from outside of US. Servers are actually isolated and get updates from local repos. Is there a US based proxmox repository for updates? Can the repository be mirrored locally? Thank you
Y

 

[tom]

Please help me to understand, why do you have such a restriction?

(Our North America download server are in Canada.)

 

[yaboc]

Hi Tom. Financial industry with strict security requirements for in-house servers. I potentially could get updates by temp connection to the outside but only to US based servers. CAN is most likely blocked as well. Just trying to see if any workaround can be achieved to keep current with updates. Or we could go without updates and just do rebuilds with every major update (would like to avoid that).

 

[tom]

We use apt as package management, so if know how you can do offline update too. But online updates would be easier, most use a http proxy for limited internet access.

 

[yaboc]

thanks Tom i will check if canadian repo is blocked (66.70.154.81) but i believe it is. i will try other options. it's not fun to run things in sych a restricted env :/

 

[LnxBil]

i will try other options. it's not fun to run things in sych a restricted env :/

Another option is obvious: get the smallest digital ocean droplet in US IP zone, install a reverse proxy and proxy the canadian server... IP address restrictions are so easy to circumvent if you live in the zone that is restricting it.

 

[yaboc]

we were able to get updates by temp connection to our 'internet' network which allows the CAN repo. That link is disabled after the update is performed. Thanks everyone for coming up with multiple ways of getting porxmox updated. I'm sure these solutions will help someone in the future.

 

[LnxBil]

we were able to get updates by temp connection to our 'internet' network which allows the CAN repo. That link is disabled after the update is performed.

If you can live with it ... it's just fine. We do a similar setup for backing up our machines. We update some servers "from the outside" and enable access to update repositories in the firewall just before running the update and disable them afterwards. Works fine.

I do not know if you can mirror the pve-enterprise repository, but you sure can mirror the other repositories (we do) and you can then have a local mirror in your company. The packages are cryptographically signed, so you will notice tampering.