OOKB - Olaf's Own Knowledge Base

When running a Debian system (Debian, Ubuntu, Cumulus, …) without internet connection, it cannot receive upgrades with apt update && apt upgrade -y
But with any Debian based system that is online, it is possible to download the required packages and dependencies (!). With only a very few systems at the same patchlevel, it might be quicker to just download the required packages as in KVM/ QEMU Extend a virtual disk. But, when the systems are at different patch levels or to ensure a system can be recovered from an image after a disaster it might be valuable to have a full repository of the used distribution.

apt install apt-mirror -y

This contains everything needed to replicate a repository I am using the fictitious distribution FreeDebian - replce it with the actually required distro. It created /etc/apt/mirror.list that needs to be amended. We need only a few active lines, but I left some commented defaults, just for information what it sets.

############# config ##################
#
set base_path    /var/spool/apt-mirror/freedebian
#
# set mirror_path  $base_path/mirror
# set skel_path    $base_path/skel
# set var_path     $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch  <running host architecture>
# set postmirror_script $var_path/postmirror.sh
# set run_postmirror 0
set nthreads     20
set _tilde 0
#
############# end config ##############
 
# if only one architecture (i386, amd64, ...) is required, add it at the end of the leading deb. The example shows that for 64-bit x86 architecture
# for multiples (but not all available) issue a line for each 
# for all available architectures, just use one line with deb (without -extension)
 
# Source repositories
deb-amd64 [signed-by=/etc/apt/trusted.gpg.d/freedebian.gpg] https://deb.freedebian.org/freedebian unstable main contrib non-free
deb-src-amd64 [signed-by=/etc/apt/trusted.gpg.d/freedebian.gpg] https://fdeb.freedebian.org/freedebian unstable main contrib non-free
 
clean http://deb.freedebian.org/freedebian

mkdir /var/spool/apt-mirror/freedebian

Start the replication with

apt-mirror

or as background task with

apt-mirror &

When the replication is finished, the whole directory should be packed and moved to the offline system for publication.

tar -czPf freedebian.tar.gz /var/spool/apt-mirror/freedebian/

On the target network with a fresh Debian installation run tasksel and select the web server.
That will install apache2 with a standard, non-ssl web site active, with the files at /var/www/html/

Unpack the archive created online:

tar -xvzPf freedebian.tgz 

link the repository to the web site:

ln -s /var/spool/apt-mirror/freedebian/deb.freedebian.org/repo /var/www/html/repo

On the clients that should use the repository modify /etc/apt/sources.list, replacing the URI of the source repository with the IP of the server installed in the step before. Ensure to use http (or configure SSL on the server).

deb [arch=amd64] http://192.168.100.41/repo FreeDebian main updates non-free
deb-src [arch=amd64] http://192.168.100.41/repo FreeDebian main updates non-free

Update apt and upgrade the client device:

apt update && apt dist-upgrade 

Done.