The Ubuntu DDoS drove me to build a new apt-cacher with two goals: be able to supply typical packages when the upstream is unavailable and be more reliable than the existing apt-cacher/apt-cacher-ng. It's looking like I'll be doing a 1.0 release next week (it's been in beta for ~3 weeks).

https://github.com/linsomniac/apt-cacher-ultra

We do ground-up respins of half of our dev+stg cluster every morning, to test our automation, but this didn't work during the DDoS. I disabled those respins for the week of the DDoS, but if we had a fire at the office and needed to bring back up our dev+stg environment that would have been a problem: our normal ansible automation wouldn't have worked to set up a new dev+stg cluster.

apt-cacher-ultra has an "adoption" process where when it detects new repo meta-data it holds off on serving it up until it has downloaded any changed "hot" packages (packages we've fetched in the last N days), then it switches over to that new snapshot of the repo. I've been able to shut down our upstream Internet and then do a new OS install and apt update+upgrade it successfully.