private Arch repository

2026-10-13

status: works (meta packages only for now)

It's finally time for me to make a serious attempt at creating my own custom repository for arch linux packages. The main use case for me is keeping my systems (desktop pc, laptops) in sync.

The plan: serve privaterepo.shiny.space behind authentication, with a few personal packages. make it very easy to edit the PKGBUILDs from anywhere and have the repo updated fast.

Structure:

- new user "privaterepo" owning /srv/privaterepo path.
- PKGBUILDS in /srv/privaterepo/packages/<pkgname>/
- actual repo in /srv/privaterepo/repo/repo.db ?
- rebuild-repo.sh somewhere easy to find (home or srv)

Caddy serving up repo.db behind http basic auth

~pkgbuilds for dynamic meta-packages (shared packages i want installed) should live in /Sync somewhere. trigger-rebuild.sh script can copy them over? maybe even a different unison sync root? complexity demon avoided, so far i am okay simply ssh'ing into the build account and triggering a rebuild while i'm there.

Important: always bump the pkgrel or pkgver on changes!

Utility script for setting up the repo, ideally in the (insert link to custom archiso i make).

Configs: caddy:

privaterepo.shiny.space {
    basicauth {
        # caddy hash-password
        user $2a$14$...
    }
    root * /srv/privaterepo/repo
    file_server
}

pacman.conf:

Include = /etc/pacman.d/privaterepo.conf

chmod 600 root only: that broke paru so the creds are user-readable again. /etc/pacman.d/privaterepo.conf

[privaterepo]
SigLevel = Optional TrustAll
Server = https://user:password@privaterepo.shiny.space

BIG warning: do NOT use special chars or spaces in the password, i could not figure out a way to quote/escape them, its easier to just use alphanumeric.

Build script:
the first iteration rebuilt every package on every run. that was annoying quick, so:

#!/bin/bash

set -e

PKGBASE="/srv/privaterepo/packages"
REPODIR="/srv/privaterepo/repo"
REPONAME="privaterepo"

for dir in "$PKGBASE"/*/; do
    [ -f "$dir/PKGBUILD" ] || continue
    echo "==> Checking $dir"

    # See what package file(s) this PKGBUILD would produce
    missing=0
    while IFS= read -r pkg; do
        [ -f "$REPODIR/$(basename "$pkg")" ] || missing=1
    done < <(cd "$dir" && makepkg --packagelist)

    if [ "$missing" -eq 0 ]; then
        echo "    Already up to date, skipping."
        continue
    fi

    echo "==> Building in $dir"
    (
        cd "$dir"
        # Clean old packages first (optional)
        rm -f ./*.pkg.tar.zst ./*.pkg.tar.xz
        makepkg --nodeps
    )

    echo "==> Adding package(s) to repo db"
    repo-add "$REPODIR/$REPONAME.db.tar.gz" "$dir"/*.pkg.tar.*
    # Move built packages into the repo dir (optional, keeps things tidy)
    mv "$dir"/*.pkg.tar.* "$REPODIR/"
done

echo "Done."

thanks kimi.

also remember to disable building "-debug" packages in your /etc/makepkg.conf

use "makepkg --nodeps" to not pull in entire desktop on the server! should be fine for meta-packages or stuff like repackaged .debs.