Add the mirror with a higher priority (a lower number) than the defaults; zypper then downloads from here and keeps the original repositories as a fallback. $releasever keeps the repository on your Leap version after an upgrade; keep the single quotes.

sudo zypper ar -f -p 90 'https://opensuse.mirrors.oiv.ae/distribution/leap/$releasever/repo/oss/' oiv-leap-oss
sudo zypper ar -f -p 90 'https://opensuse.mirrors.oiv.ae/distribution/leap/$releasever/repo/non-oss/' oiv-leap-non-oss
sudo zypper ref

On Leap 16, updates and security fixes are published into repo/oss and repo/non-oss; there is no separate update repository.

Check and undo

The oiv- repositories should be listed with priority 90. To undo, remove them.

zypper lr -uP
sudo zypper rr oiv-leap-oss oiv-leap-non-oss

Verify the signature yourself

zypper checks the repository metadata with the openSUSE Project Signing Key, which is already on your system (package openSUSE-build-key). Do not take the key from this mirror: the original is at download.opensuse.org/…/repomd.xml.key; its fingerprint and validity are published by openSUSE on openSUSE: Signing Keys.

curl -fsSO https://download.opensuse.org/distribution/leap/16.1/repo/oss/repodata/repomd.xml.key
gpg --show-keys --with-fingerprint repomd.xml.key       # compare with openSUSE: Signing Keys
gpg --import repomd.xml.key
curl -fsSO https://opensuse.mirrors.oiv.ae/distribution/leap/16.1/repo/oss/repodata/repomd.xml
curl -fsSO https://opensuse.mirrors.oiv.ae/distribution/leap/16.1/repo/oss/repodata/repomd.xml.asc
gpg --verify repomd.xml.asc repomd.xml                  # Good signature from "openSUSE Project Signing Key"

1. Sign in to the OPNsense web interface.
2. Go to System ▸ Firmware ▸ Settings.
3. In Mirror, choose (custom) and enter the mirror address, without a path (OPNsense adds the ABI and release itself):

   https://opnsense.mirrors.oiv.ae

4. Select Save, then go to Status and select Check for updates.

To undo, set Mirror back to (default) and save.

Verify downloaded images yourself

OPNsense signs its images and checksum files with an RSA key per release series. Take the public key from the original site, not from this mirror: pkg.opnsense.org/releases/26.1/OPNsense-26.1.pub (the key of the newest series is also printed in pkg.opnsense.org/releases/mirror/README). OPNsense describes the check in its installation guide; it publishes no key fingerprint, so compare the key with the copies on opnsense.org, the OPNsense forum and the project's GitHub.

curl -fsSO https://pkg.opnsense.org/releases/26.1/OPNsense-26.1.pub
curl -fsSO https://opnsense.mirrors.oiv.ae/releases/26.1/OPNsense-26.1.6-checksums-amd64.sha256
curl -fsSO https://opnsense.mirrors.oiv.ae/releases/26.1/OPNsense-26.1.6-checksums-amd64.sha256.sig
openssl base64 -d -in OPNsense-26.1.6-checksums-amd64.sha256.sig -out checksums.sig
openssl dgst -sha256 -verify OPNsense-26.1.pub -signature checksums.sig OPNsense-26.1.6-checksums-amd64.sha256   # Verified OK
openssl sha256 OPNsense-26.1.6-dvd-amd64.iso.bz2        # compare with the line in the checksum file

Debian packages: the archive and the security archive are being copied; the how-to for apt appears here as soon as the first sync has finished. Until then keep deb.debian.org and security.debian.org. The installation images are available now (below).

apt checks the archives with the Debian archive keys from the package debian-archive-keyring. The originals and their fingerprints are on Debian's own page ftp-master.debian.org/keys.html (the Debian 13 archive key and the Debian 13 security key).

Installation images, same layout as cdimage.debian.org (current release; see the list above for the image sets): https://debian.mirrors.oiv.ae/debian-cd/

Verify the images yourself

Debian signs the checksum files (SHA512SUMS.sign, SHA256SUMS.sign) with the Debian CD signing key. Get the key from Debian, not from this mirror, and compare its fingerprint with the one Debian publishes on debian.org/CD/verify (key server of the Debian project: keyring.debian.org).

curl -fsS 'https://keyring.debian.org/pks/lookup?op=get&search=debian-cd@lists.debian.org' | gpg --import
gpg --fingerprint debian-cd@lists.debian.org                    # compare with debian.org/CD/verify
curl -fsSO https://debian.mirrors.oiv.ae/debian-cd/current/amd64/iso-dvd/SHA512SUMS
curl -fsSO https://debian.mirrors.oiv.ae/debian-cd/current/amd64/iso-dvd/SHA512SUMS.sign
gpg --verify SHA512SUMS.sign SHA512SUMS                         # Good signature from "Debian CD signing key"
sha512sum -c --ignore-missing SHA512SUMS                        # after downloading the image

Proxmox VE 9 without a paid subscription (the case for this mirror: it carries the pve-no-subscription and pve-test repositories, not the enterprise one). Two changes, then apt update:

1. Switch the enterprise repository off. A new installation enables it, and without a subscription key it only produces errors. In /etc/apt/sources.list.d/pve-enterprise.sources add the line Enabled: no (if ceph.sources uses the enterprise repository, do the same there). In the web interface: Node → Updates → Repositories, select the entry, Disable.
2. Point the no-subscription repository to this mirror, in /etc/apt/sources.list.d/proxmox.sources: replace the host name only.

Types: deb
URIs: https://proxmox.mirrors.oiv.ae/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

If the host still has the older one-line file /etc/apt/sources.list.d/pve-no-subscription.list, take it out of sources.list.d (keep a copy elsewhere) once proxmox.sources is in place, or disable the entry in the web interface: the same repository twice makes apt print warnings. The Debian base of the host stays as it is (see Debian below), and so do the Ceph repositories. Proxmox describes the no-subscription repository as meant for testing and non-production use. The “No valid subscription” notice of the web interface is Proxmox's own and stays. To undo, put back download.proxmox.com.

Verify the signature yourself

apt checks the repository with the Proxmox release key from your host (proxmox-archive-keyring). The original keyring is on Proxmox's own server, not on this mirror: proxmox-archive-keyring-trixie.gpg; its checksum is published by Proxmox on Proxmox's Package Repositories page. It holds the Proxmox Trixie Release Key and the Proxmox Bookworm Release Key.

apt install gpgv                                                # once: the check needs gpgv
curl -fsSO https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg
sha256sum proxmox-archive-keyring-trixie.gpg                    # compare with Proxmox's page
curl -fsSO https://proxmox.mirrors.oiv.ae/debian/pve/dists/trixie/InRelease
gpgv --keyring ./proxmox-archive-keyring-trixie.gpg InRelease   # Good signature from "Proxmox Trixie Release Key"

Installation images, same layout as download.proxmox.com: https://proxmox.mirrors.oiv.ae/iso/

Release signing keys: https://proxmox.mirrors.oiv.ae/debian/ (e.g. proxmox-release-bookworm.gpg; a Proxmox VE 9 host already has its keyring from the package proxmox-archive-keyring); verify them against Proxmox's Package Repositories page.

Downstream mirrors are welcome. Copy a project to your own server, for a campus, office or ISP network. Use the project's host name; the rsync module is the project name.

rsync -avH --delete --delay-updates \
  rsync://opensuse.mirrors.oiv.ae/opensuse/ /srv/mirror/opensuse/

• -H keeps hard links, which the openSUSE tree uses heavily.
• --delete removes files that were removed upstream.
• --delay-updates puts updated files in place at the end, so clients never see a half-synced repository.

Over TLS (port 874): the same modules, and your mirror can check that it talks to this server. rsync-ssl comes with rsync and verifies our certificate against the system CA store and the host name in the URL:

rsync-ssl -avH --delete --delay-updates \
  rsync://opensuse.mirrors.oiv.ae/opensuse/ /srv/mirror/opensuse/

Use the host name, never an IP address. Leave RSYNC_SSL_CA_CERT unset and never set RSYNC_SSL_CA_CERT= (empty), RSYNC_SSL_SKIP_HOSTNAME_CHECK=1 or RSYNC_SSL_ALLOW_INSECURE_*: each one turns the check off. If TLS fails, do not fall back to plain rsync without noticing.

Schedule it with a systemd timer. Sync at most every 4 hours, never in our business hours (Mon–Fri 08:30–17:00 Asia/Dubai), preferably at night (22:00–06:00), and add a random delay. Check your disk space against the size of the tree first, and tell us your mirror's address so we can plan capacity.

# /etc/systemd/system/mirror-downstream.timer
[Timer]
OnCalendar=*-*-* 22,02:17:00 Asia/Dubai
RandomizedDelaySec=15m
Persistent=true

[Install]
WantedBy=timers.target