Package cache

FAQ › EUZOS Server › Package cache · Nederlands

What is it?

The Package cache (package id cache) is a local copy of download.euzos.eu inside the company. The EUZOS Server downloads apps (such as Chromium, 411 MiB) once and serves them to the EUZOS PCs on the LAN; later also EUZOS updates. 50 PCs then fetch Chromium once over the internet instead of 50 times, and installing goes at LAN speed.

It runs on top of Workplace management: the same HTTPS server on TCP port 8445, the same keys and sign-in at the profile server. The cache only serves when both packages are on. Design and threat model: docs/PACKAGE-CACHE.md.

How do I…?

How do I turn the package cache on?

The installer turns it on by default (step Packages). On a server installed before 27-10-2026, or after turning it off:

serveradmin <server> package-on cache
serveradmin <server> firewall-open allow tcp 8445 lan

package-on cache writes \EOS\FW\CACHE.TXT if it is missing and starts filling. The firewall stays closed until you open port 8445 for the LAN.

How do I see what is in the cache?

serveradmin <server> cache (or workplace on the server console): the state, the usage (used, quota, area), and per app the version, the size, pre-fetched or on demand, the last use, the number of requests and the bytes served; then the on-demand queue and the last fill message.

How do I empty the cache?

serveradmin <server> cache-clear            shows what will happen
serveradmin <server> cache-clear confirm    and does it

Every app is removed. The PCs fetch from download.euzos.eu until the next round (every 30 minutes, or serveradmin <server> fill) has filled the pre-fetched apps again.

How do I choose which apps are pre-fetched?

serveradmin <server> apps chromium,srvadmin (stored as apps= in WORKPLC.TXT). Other apps are filled on demand: the first PC that asks for one with a valid download token gets "not in the cache" and falls back to download.euzos.eu; the server then fetches it, and the next PC gets it from the cache.

How does a PC find the cache?

The app catalogue of the profile server names the cache (werkplek=https://<LAN IP>:8445/, werkplek-tls=<pin>) when the PC asks from the same public address as the server.
If that does not work (several sites behind one NAT, a VPN), put \EOS\FW\PKGCACHE.TXT on the PC:

   url=https://<lan-address>:8445/
   tls=<the tls-pin that 'workplace' shows on the server>

Later: mDNS in the local network.

If the cache does not answer or anything is wrong, the PC simply continues at download.euzos.eu.

Can a hacked cache give PCs a bad Chromium?

No. Every file is signed by EUZOS; the PC checks the signature, the version (no older one than before), the size, the SHA-256 and the block hash itself, exactly as for download.euzos.eu. A bad cache can only make a download fail; the PC then falls back.

Who may download from the cache?

Only a PC with a valid download token from the profile server (a logged-in PC; one app and version, 2 hours). The cache checks the token itself, with the public key it gets at every sign-in. Known gap: revoked tokens are not known to the cache yet; they expire within 2 hours.

Details

Storage (MVP): the apps/ area on partition 2 (2 GiB, at most 4 apps). quota-mib= in CACHE.TXT limits it further.
LRU eviction: when a new app or version does not fit, the cache first removes apps that were filled on demand, least recently used first, then pre-fetched ones; never the one being filled. If it does not fit at all: too_large in the log.
New versions: every round compares the catalogue version with the cached one and fetches a new version in the background; the old version keeps serving until the new one is complete.
Resume: an interrupted download continues with Range at the same source (206 Content-Range).
Off: package-off cache confirm closes port 8445 in the firewall and the port refuses connections; the contents stay. Workplace management off also stops the cache.

Reference

Server Admin

Command	What
`package-on cache`	set up (CACHE.TXT) and turn on
`package-off cache [confirm]`	turn off; closes 8445
`cache`	usage and contents
`cache-clear [confirm]`	empty the cache (wire action `cache-clear`, argument `bevestig`)
`fill`	sign in and fill now
`apps <a,b>`	the pre-fetched apps

Reason codes: needs_workplace (Workplace management is not set up), package_not_installed (turning off a cache that is not set up), confirmation_needed.

Config files

File	Key	Values	Meaning
`\EOS\FW\CACHE.TXT` (server)	`role`	`cache`	without it the package is not set up
	`quota-mib`	0 – 1048576	the quota in MiB; 0: the whole area
	`on-demand`	`yes` / `no`	fill an app after a miss with a valid token
	`package`	`off`	turned off with Server Admin
`\EOS\FW\PKGCACHE.TXT` (PC)	`url`	`https://<IPv4>:<port>/`	the cache in this network
	`tls`	64 hex	SHA-256 of the server's SPKI (the TLS pin)

HTTP on port 8445

GET|HEAD /<app>/<version>/<file> with Authorization: Bearer ezdl1.… and at most one Range. Files: <NAME>.APP, <NAME>.APP.sig, the package. 200 / 206 / 416; 401 geen_token, handtekening, verlopen; 403 ander_pad; 404 not_in_cache (and queued on demand), pad, beschadigd (the stored description does not verify); 503 klok.

Code

Item	Role
`euzos_pkgcache::config`	read/write `CACHE.TXT`
`euzos_pkgcache::lru::{plan, report}`	quota, eviction plan, usage report
`euzos_pkgcache::serve::decide`	token + contents → serve / deny / miss
`euzos_pkgcache::verify`	the end-to-end checks (description signature, package SHA-256)
`euzos_pkgcache::hint`	`PKGCACHE.TXT`, mirror URLs
`crate::pkgcache` (`kernel/src/server/cache.rs`)	state, on/off, fill round, statistics, `cache-clear`
`crate::workplace::respond`	the HTTPS server on 8445
`app_store::install_catalog`	PC side: the cache first, then the catalogue URLs