This is where a LocalGhost box gets the files it downloads once, at setup. Every file here is a copy of something already public (or cut from it), published with the terms it came under, and listed in a manifest signed with the same key that signs every deploy of this site.
The mirror started in September 2026 with three sets, geo, landtiles and go. The pinned llama.cpp source and the model weights are already in the config but not published yet. The weights wait until the terms that have to travel with them are complete.
> 1. WHAT IT CARRIES
Files come in sets, and a box asks for a set by name. Each set sits in its own folder with a TERMS file per licence and a NOTICE.txt that says which file is under which terms and where it came from.
| Set | Files | Where it comes from | Terms |
|---|---|---|---|
| geo | admin1CodesASCII.txt admin2Codes.txt countryInfo.txt allCountries.zip |
The GeoNames data dumps, unmodified. The box uses them for reverse geocoding. | CC BY 4.0[1] |
| geo | world.geojson world-50m.geojson world-110m.geojson |
Natural Earth's country boundaries at three scales (10m, 50m and 110m), renamed only. The base of the map. | Public domain[2] |
| landtiles | landtiles.tar.gz |
OpenStreetMap's land polygons, cut on the server into one-degree tiles for the map's coastline. | ODbL 1.0[3] |
| go | go1.25.4.linux-amd64.tar.gz |
The official Go release, checked against go.dev's published SHA-256 before it's mirrored. Setup needs it before any Go exists on the box. | BSD 3-Clause[4] |
| llama | llama.cpp-<commit>.tar.gz |
GitHub's source archive of one pinned commit of the inference engine. Not published yet. | MIT[5] |
| models | Gemma 4 12B (Q4_K_M) and its vision projector, EmbeddingGemma 300M | GGUF conversions of Google's weights for llama.cpp. Not published yet. | Apache 2.0[6], Gemma Terms of Use[7] |
> 2. WHY A MIRROR
Before this, setting up a box meant fetching from four different places on the day (GeoNames, GitHub, the OpenStreetMap data server and Google's Go downloads) and trusting each of them to be up, to serve the same bytes it served last week, and not to keep a record of who asked. Any one of the four being slow or down made setup slow or broken, and none of them owes a LocalGhost box anything.
The coastline was the worst of it. OpenStreetMap's land polygons arrive as one large shapefile that has to be cut into the tiles the map reads, which takes a few minutes and a couple of GB of RAM. The mirror does that once, on the server, and every box downloads the finished tiles instead.
Pinning matters more for code than for data. A box that builds llama.cpp from whatever master was that morning can end up running something different from the box next to it, so the mirror will carry one commit, named in the file, and a new pin is a new file name that makes boxes rebuild.
It's also one less set of logs. This site runs with access logging off, the mirror included, so nothing here records the IP address of a box that set itself up. Fetching from each upstream directly would tell every one of them.
> 3. HOW A BOX CHECKS IT
Boxes fetch from here with tools/mirror_fetch.sh in the server repo, and install nothing unless every check passes.
- It downloads
MANIFEST.txtandMANIFEST.txt.ascand verifies the signature againsttools/mirror-key.asc, the public key committed in the server repo, in a throwaway gpg home so nothing in your own keyring is involved. - It requires the mirror's own header on the manifest, so another manifest signed by the same key (a release, or a deploy of this site) can't be passed off as a mirror manifest.
- It refuses a build older than the last one that box used (the build name is kept in
/var/lib/ghost/mirror-build), so an old manifest with a perfectly valid signature can't be replayed to roll a box back. - It downloads each file under a temporary name, resuming if the connection drops, and only gives it its real name once its SHA-256 matches the manifest.
If the mirror can't be reached or a check fails, the setup scripts fall back to the upstream source, so the mirror can make setup faster and more predictable but it can't stop a box from being set up. GHOST_MIRROR=off skips it entirely, and GHOST_MIRROR=<url> points a box at a copy you host yourself.
> 4. HOW IT'S BUILT
The mirror is rebuilt on every deploy of this site, by a script that sits next to the deploy script in the web repo and is never served. It downloads a file again only when upstream says it changed, stops if the Go tarball doesn't match go.dev's checksum, and refuses to publish anything whose terms file isn't finished.
A publish that changes something goes into a new folder named after the time it was built (20260924T120000Z, say). A folder never changes once it's published. Sets that didn't change are hard-linked from the previous build rather than copied, and the last two builds are kept, so a box halfway through a download when the next build lands still gets the bytes its manifest named. The manifest and its signature are written last and only go live once every file they name is already in place. When nothing changed upstream there's no new build at all.
/mirror/MANIFEST.txt # sha256 of every file, one per line /mirror/MANIFEST.txt.asc # signature, info@localghost.ai /mirror/<build>/<set>/<file> # the files /mirror/<build>/<set>/TERMS-<name>.txt # the terms a file is under /mirror/<build>/<set>/NOTICE.txt # which file, which terms, from where
> 5. CHECK IT YOURSELF
You don't need a box to check any of this. The key is the one published at /.well-known/pgp-key.asc, the same key that signs every deploy of this site.
curl -sO https://www.localghost.ai/mirror/MANIFEST.txt
curl -sO https://www.localghost.ai/mirror/MANIFEST.txt.asc
curl -s https://www.localghost.ai/.well-known/pgp-key.asc | gpg --import
gpg --verify MANIFEST.txt.asc MANIFEST.txt
# then any file against its line in the manifest, the Go tarball for example
BUILD=$(sed -n 's/^# Build: //p' MANIFEST.txt)
curl -sO https://www.localghost.ai/mirror/$BUILD/go/go1.25.4.linux-amd64.tar.gz
grep " /$BUILD/go/go1.25.4.linux-amd64.tar.gz$" MANIFEST.txt | sed "s| /$BUILD/go/| |" | sha256sum -c
> 6. TERMS
Every file is published under the terms it came with, and those terms travel with it in the same folder. GeoNames data is CC BY 4.0.[1] Natural Earth is in the public domain.[2] The coastline tiles are a derivative database of OpenStreetMap's land polygons, offered under the same Open Database License as the original, and the method that produced them is published as source code in the LocalGhost repository.[3] Go is BSD 3-Clause[4] and llama.cpp is MIT.[5]
Google released Gemma 4 under Apache 2.0 in April 2026.[6] EmbeddingGemma is still under the Gemma Terms of Use, which have to be handed to everyone who receives the model, in full, with its use restrictions intact.[7] The publish refuses a model until its terms file is complete, which is the main reason the weights aren't here yet.
Postgres and Redis still come from their own apt repositories at setup, and I haven't decided yet whether mirroring those is worth the work. If you maintain one of the sources above and want it handled differently, or you find a file here that doesn't match its manifest, email info@localghost.ai.
> REFERENCES
geo set's place names, publishes its data dumps under the Creative Commons Attribution 4.0 licence. Source for the GeoNames terms. geonames.org and creativecommons.org/licenses/by/4.0internal/landtiles in the LocalGhost repository. osmdata.openstreetmap.de/data/land-polygons.html, opendatacommons.org/licenses/odbl/1-0 and openstreetmap.org/copyright