Policy

Short version: help yourself, do not hammer it, and do not treat it as a guarantee. The mirror is infrastructure we run for our own estate and expose because keeping it private would cost more than letting it be read.

Access

• Unauthenticated and read-only over HTTPS. No accounts, no tokens, no per-client quotas.
• GET and HEAD only. Every other method returns 405.
• Soft rate limit of roughly 40 requests/second per source address. Exceeding it delays you rather than blocking you; a sustained excess is dropped at the edge.

Availability

• Best effort. There is no SLA and no support queue attached to this endpoint.
• Maintenance happens inside the sync window; reads stay served from the previous snapshot while a sync is running, so a run is not an outage.
• If the mirror is down, direct installation still works — that is the point of keeping the exclude block in the sample configuration.

Content

• Provider archives, checksum files and signatures are byte-for-byte copies of upstream artefacts. We do not repackage, re-sign, patch, or strip anything.
• Licensing follows the upstream provider. Mirroring changes nothing about the terms you accepted when you took the provider from the registry.
• A takedown or a correction request goes to noc@fadminops.space and is actioned within one business day.

Logging

• Access logs keep source address, timestamp, request line, status and byte count for 14 days, then rotate out. They are used for capacity planning and abuse handling, nothing else.
• No cookies are set and no analytics are loaded. The one script on these pages formats timestamps in your browser and talks to nothing.

Adding a namespace

Storage is provisioned per namespace, so new ones are added deliberately rather than on demand. If you depend on a provider we do not carry, mail noc@fadminops.space with the provider address and a rough idea of version depth, and it will be picked up in the next capacity review.