From 1f2410e997637c030cfb125db4b2b6aeedc64d3b Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:23:50 +0100
Subject: [PATCH] Add apt mirror fallback for Debian/Ubuntu

Enhance apt-get update handling for Debian/Ubuntu/Devuan containers by adding regional mirror lists and a fallback routine. The script now detects container timezone to prefer regional mirrors, builds a randomized candidate list, probes each mirror (timeout on TCP:80), rewrites /etc/apt/* sources to use a working mirror, and retries apt-get update until success. Keeps the existing non-interactive dist-upgrade and cleans up apt lists as before. This improves reliability of updates inside LXC containers when default mirrors are unreachable or misbehaving.
---
 tools/pve/update-lxcs-cron.sh | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/tools/pve/update-lxcs-cron.sh b/tools/pve/update-lxcs-cron.sh
index 1f35d341..22bd5e23 100644
--- a/tools/pve/update-lxcs-cron.sh
+++ b/tools/pve/update-lxcs-cron.sh
@@ -36,14 +36,29 @@ function update_container() {
   archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
   fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
   ubuntu | debian | devuan) pct exec "$container" -- bash -c '
+    EU_MIRRORS="ftp.de.debian.org ftp.fr.debian.org ftp.nl.debian.org ftp.uk.debian.org ftp.ch.debian.org ftp.se.debian.org ftp.it.debian.org ftp.fau.de ftp.halifax.rwth-aachen.de debian.mirror.lrz.de mirror.init7.net debian.ethz.ch mirrors.dotsrc.org debian.mirrors.ovh.net"
+    US_MIRRORS="ftp.us.debian.org ftp.ca.debian.org debian.csail.mit.edu mirrors.ocf.berkeley.edu mirrors.wikimedia.org debian.osuosl.org mirror.cogentco.com"
+    AP_MIRRORS="ftp.au.debian.org ftp.jp.debian.org ftp.tw.debian.org ftp.kr.debian.org ftp.hk.debian.org ftp.sg.debian.org mirror.aarnet.edu.au mirror.nitc.ac.in"
+
+    TZ=$(cat /etc/timezone 2>/dev/null || echo "UTC")
+    case "$TZ" in
+      Europe/*|Arctic/*) REGIONAL="$EU_MIRRORS"; OTHERS="$US_MIRRORS $AP_MIRRORS" ;;
+      America/*) REGIONAL="$US_MIRRORS"; OTHERS="$EU_MIRRORS $AP_MIRRORS" ;;
+      Asia/*|Australia/*|Pacific/*) REGIONAL="$AP_MIRRORS"; OTHERS="$EU_MIRRORS $US_MIRRORS" ;;
+      *) REGIONAL=""; OTHERS="$EU_MIRRORS $US_MIRRORS $AP_MIRRORS" ;;
+    esac
+
     apt-get update || {
       echo "Acquire::By-Hash \"no\";" >/etc/apt/apt.conf.d/99no-by-hash
-      echo "Acquire::AllowInsecureRepositories \"true\";" >>/etc/apt/apt.conf.d/99no-by-hash
-      rm -rf /var/lib/apt/lists/*
-      apt-get update --allow-insecure-repositories
-      echo "Acquire::By-Hash \"no\";" >/etc/apt/apt.conf.d/99no-by-hash
-      rm -rf /var/lib/apt/lists/*
-      apt-get update || true
+      ALL_MIRRORS="$(printf "%s\n" $OTHERS | shuf | head -3 | xargs) ftp.debian.org $(printf "%s\n" $REGIONAL | shuf | head -3 | xargs)"
+      for mirror in $ALL_MIRRORS; do
+        timeout 2 bash -c "echo >/dev/tcp/$mirror/80" 2>/dev/null || continue
+        for src in /etc/apt/sources.list.d/debian.sources /etc/apt/sources.list; do
+          [ -f "$src" ] && sed -i "s|URIs: http[s]*://[^/]*/|URIs: http://${mirror}/|g; s|deb http[s]*://[^/]*/|deb http://${mirror}/|g" "$src"
+        done
+        rm -rf /var/lib/apt/lists/*
+        if apt-get update; then echo "  Using mirror: $mirror"; break; else echo "  Mirror $mirror failed"; fi
+      done
     }
     DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confold" dist-upgrade -y
     rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED' ;;