fix: correct proxy routing, caching, and URL rewriting

internal/cli/daemon.go

@@ -457,7 +457,7 @@ func (s *Server) createFiberApp() *fiber.App {
 	// Static assets (must be registered before the catch-all proxy below).
 	app.Get("/static/apt-proxy-logo.png", adaptor.HTTPHandler(http.HandlerFunc(proxy.ServeStaticLogo)))
 	// All other paths -> proxy + cache
-	app.All("/*", adaptor.HTTPHandler(s.proxy.Handler))
+	app.All("/*", adaptor.HTTPHandler(s.proxy))
 
 	return app
 }

internal/mirrors/mirrors.go

@@ -73,20 +73,18 @@ var builtinByMode = map[int]builtinDistro{
 // for the given proxy mode. When reg is non-nil, registry-loaded
 // mirrors are preferred over the compile-time built-ins.
 func GetGeoMirrorUrlsByMode(reg *distro.Registry, mode int) (mirrors []string) {
-	// Ubuntu/UbuntuPorts: prefer geo-derived mirrors (real point of the
+	// Ubuntu: prefer geo-derived mirrors (real point of the
 	// `mirrors.txt` lookup). Fall back to registry/built-in on failure so
 	// the proxy still has *some* upstream list when the geo API is down.
-	if mode == distro.TypeUbuntu || mode == distro.TypeUbuntuPorts {
+	//
+	// Ubuntu Ports: use built-in list directly. The geo API returns Ubuntu
+	// (amd64) mirrors only; blindly replacing /ubuntu/ with /ubuntu-ports/
+	// produces URLs that do not serve ports content (e.g. archive.ubuntu.com
+	// only serves amd64).
+	if mode == distro.TypeUbuntu {
 		online, err := GetUbuntuMirrorUrlsByGeo()
 		if err == nil && len(online) > 0 {
-			if mode == distro.TypeUbuntu {
-				return online
-			}
-			results := make([]string, 0, len(online))
-			for _, m := range online {
-				results = append(results, strings.ReplaceAll(m, "/ubuntu/", "/ubuntu-ports/"))
-			}
-			return results
+			return online
 		}
 		// Geo failed: fall through to registry/built-in.
 	}

internal/proxy/handler.go

@@ -15,6 +15,7 @@
 package proxy
 
 import (
+	"crypto/tls"
 	"errors"
 	"io"
 	"net/http"
@@ -104,6 +105,10 @@ func NewUpstreamTransport(enableKeepAlive bool) *http.Transport {
 		MaxIdleConns:          DefaultMaxIdleConns,
 		IdleConnTimeout:       DefaultIdleConnTimeout,
 		DisableCompression:    false,
+		// Disable HTTP/2: upstream mirrors use plain HTTP/1.1.
+		// HTTP/2 HPACK encoder has a known race that panics under
+		// concurrent use (golang/go#70380).
+		TLSNextProto: make(map[string]func(string, *tls.Conn) http.RoundTripper),
 	}
 }
 
@@ -342,6 +347,7 @@ func (ap *PackageStruct) processMatchingRule(r *http.Request, rules []distro.Rul
 	}
 
 	r.Header.Del("Cache-Control")
+	r.Header.Del("Range")
 	if rule.Rewrite {
 		ap.rewriteRequest(r, rule)
 	}

internal/proxy/rewriter.go

@@ -20,6 +20,7 @@ import (
 	"net/http"
 	"net/url"
 	"regexp"
+	"strings"
 	"sync"
 
 	logger "github.com/soulteary/logger-kit"
@@ -355,7 +356,13 @@ func RewriteRequestByMode(r *http.Request, rewriters *URLRewriters, mode int) {
 
 	r.URL.Scheme = rewriter.mirror.Scheme
 	r.URL.Host = rewriter.mirror.Host
-	r.URL.Path = rewriter.mirror.Path + unescapedQuery
+
+	mirrorPath := rewriter.mirror.Path
+	// For Debian security archive: adjust /debian/ → /debian-security/
+	if len(matches) >= 2 && matches[1] == "-security" {
+		mirrorPath = strings.TrimRight(mirrorPath, "/") + "-security/"
+	}
+	r.URL.Path = mirrorPath + unescapedQuery
 }
 
 // MatchingRule finds a matching rule for the given path