Hello
My setup is sys-updatecacher for qubes.UpdatesProxy, with sys-whonix as netvm. sys-updatecacher uses apt-cacher-ng, configured as described in notes/apt-cacher-ng.md at master · unman/notes · GitHub
Currently, update-torbrowser returns error 403 when ran without flags (likely due to apt-cacher-ng not having support for https:// URLs, i.e for TLS) and error 503 when ran with --onion.
Any suggestions?
One solution is to edit /etc/qubes/policy.d/30-user.policy with:
qubes.UpdatesProxy * whonix-workstation-18 @default allow target=sys-whonix
That way it doesn’t use sys-updatecacher anymore. Otherwise apt-cacher-ng tries to handle the traffic on the http://127.0.0.1:8082 proxy, but is meant to work only with apt stuff.
It looks like you solved this already, but just in case, update-torbrowser doesn’t use apt at all, it gets Tor Browser from the latest official tarball. So apt-cacher-ng probably will mess with things there.
Beyond that, it’s worth noting that apt-cacher-ng frequently behaves in very broken ways for many users. Whonix’s build system used to use it, but stopped because it was causing build failures. We switched to approx, which is more complicated to set up and still requires some workarounds to make it work perfectly, but it does work. Of course, that probably isn’t all that useful to you since you’d have to modify sys-updatecacher to use approx, but maybe it’s useful to someone who finds this post while searching for apt-cacher-ng.