如何用Chocolatey以星型拓扑将多仓库同步至中心仓库？

Alright, let's break down how to sync your Chocolatey repositories across untrusted domains and multiple network segments—since DFS is off the table due to missing cross-domain trusts, here are practical, battle-tested solutions I’ve recommended to teams in similar spots:

1. Chocolatey CLI + Scheduled Tasks (Open-Source Friendly) #

If you’re running the open-source Chocolatey Server, you can use Chocolatey’s native tools to push or pull packages between repos without relying on domain infrastructure:

• Pull-based sync: Configure each target repo’s Chocolatey Server to use your main repo as an upstream source. Edit the web.config file on each target server to add the upstream URL and authentication details (API key or basic auth if your main repo is secured). Then set up a Windows Scheduled Task to run choco sync at regular intervals—this triggers the target server to pull new/updated packages from the main repo.
• Push-based sync: From your main repo server, create a scheduled task that iterates through your packages directory and runs choco push --source <TARGET_REPO_URL> --api-key <TARGET_API_KEY> for each package. This pushes updates out to all target repos directly.
• Key notes: Ensure all repos can reach each other over the network (open port 80/443 as needed) and store API keys securely (use Windows Credential Manager or encrypted config files to avoid plaintext exposure).

2. Cross-Domain File Sync Tools (No Domain Trust Required) #

Since DFS relies on domain trusts, swap it out for file-level sync tools that work with local credentials or direct network access:

• Robocopy (Windows Built-In): Use this robust command-line tool to mirror your main repo’s packages directory to target repos. Example command:

  robocopy \\main-repo-server\choco-packages \\target-repo-server\choco-packages /MIR /Z /R:3 /W:5
  

  Pair this with a scheduled task, and use net use to pre-authenticate to the target share with a local user account (stored in Windows Credential Manager to avoid hardcoding credentials).
• FreeFileSync (Open-Source GUI/CLI): This tool supports bidirectional sync, scheduled tasks, and works with SMB shares across untrusted domains. Set up a sync job pointing to your main and target package directories, save the configuration as a batch file, then create a scheduled task to run FreeFileSync.exe your-sync-config.ffs_batch on a schedule.
• Rsync (Cross-Platform): If you have Linux-based Chocolatey repos or want a cross-platform option, use cwRsync (Windows port) or native rsync on Linux. Sync over SSH for secure transfer, or use SMB shares—perfect for mixed OS environments.
• Key notes: After syncing, Chocolatey Server usually auto-detects new packages, but if not, restart the ChocolateyServer service to trigger a reindex.

3. Cloud Storage as a Middleman #

If direct network connectivity between segments is tricky, use cloud storage as an intermediary sync layer:

• Set up a scheduled task on your main repo server to sync packages to a cloud storage bucket (Azure Blob Storage, AWS S3, etc.) using tools like AzCopy or AWS CLI. Example AzCopy command:

  azcopy sync "C:\chocolatey\packages" "https://yourstorageaccount.blob.core.windows.net/choco-packages" --recursive
  

• On each target repo server, create another scheduled task to pull packages from the cloud bucket to the local Chocolatey packages directory using the same tooling.
• Key notes: Lock down cloud bucket access with IAM policies or SAS tokens to ensure only your repo servers can access the data. Adjust sync frequency based on how often you update packages.

4. Chocolatey For Business (CFB) Multi-Site Sync (Enterprise-Grade) #

If your organization has the budget, CFB’s official multi-site sync is the most robust, low-maintenance option:

• CFB’s Central Management lets you configure a network of Chocolatey repos that automatically sync packages, configurations, and policies—no domain trusts required, just network connectivity between nodes.
• It includes built-in security features like encrypted package transfer, role-based access control, and audit logs, which is ideal for enterprise environments.
• Key notes: This is a paid solution, but it eliminates the need to build and maintain custom sync workflows.

Final Recommendations #

• For open-source environments: Start with Chocolatey CLI + scheduled tasks or Robocopy—they’re free, built on Windows tools, and require minimal setup.
• For complex network layouts: Use cloud storage as a middleman to avoid direct cross-segment connectivity issues.
• For enterprise teams: Invest in CFB to get official support and a fully integrated sync solution.

内容的提问来源于stack exchange，提问作者Acerbity