Currently we use our public mirror (mirrors.wikimedia.org) as the main source to install packages (except apt.wikimedia.org for WMF-local packages and security.debian.org for security updates, which are not mirrored).
That's working well, but mirrors.wikimedia.org is a non-redundant server, so if it goes down (for a failure of any sort or for a reimage) package installations (and all Puppet runs) would fail. It doesn't make sense to setup a second mirror just for that edge case, but we should create the possibility to switch to a different Debian mirror temporarily (ideally deb.debian.org). For that to happen we need two things:
- Manage /etc/apt/sources.list with Puppet (T158562)
- Allow deb.debian.org (or whatever mirror gets configured in Hiera) in the proxies