Guidance for [[transparent] proxy cache] partial mirrors?

Do unofficial/non-blessed downstream mirrors need to do anything special in order to mirror TUF repos? I should read the spec more closely,but guidance on how and whether this should be done would be useful to link to.

Does squid just work (as a transparent caching proxy)?

Can private partial mirrors also host (other) local packages? Does that need to be on a separate server?

Use cases:

• mirror PyPI
  • devpi, bandersnatch
• mirror DockerHub
  • pulpproject
    • "DOC,SEC: Docker Notary / TUF support"
      https://pulp.plan.io/issues/7419
• mirror a TUF "upstream origin" (?) for CI services; in order to conserve bandwidth

Questions:

• Ctrl-F the spec for "mirror":
  • mirror role
  • mirrors.json
    • Private/internal mirrors are not listed in mirrors.json, correct?
• Are these use cases similar to #108 "How do we initialize trust with local metadata, and no access to a remote repository?"?

Start by reading the TUF specification sections on the mirror role and mirrors.json, then compare them with the use cases listed here: Squid, private partial mirrors, PyPI, and DockerHub. Resolve whether internal mirrors need special configuration, whether they may host local packages, and how this relates to issue #108; done means producing linkable guidance for these cases.