Package Repositories

pypiserver is a minimal PyPI-compatible server that serves packages from regular directories, so pip and twine talk to it as they would to PyPI. Start it on a folder with pypi-server run -p 8080 ~/packages, then copy your packages in, or upload them with twine. Its docs strongly advise you to password-protect uploads with an htpasswd file. A package it doesn't have redirects pip to PyPI.

devpi pairs a PyPI-compatible server with a command-line tool for packaging, testing, and release. For a cache alone, install devpi-server and point pip at its root/pypi index. Once pip has fetched a file through it, that file installs offline too. For your own packages, add devpi-web and devpi-client, and create an index based on root/pypi, so all of PyPI shows up beside your uploads. devpi upload publishes a release there, devpi test runs tox against it and records the result, and devpi push sends it on to a staging index or to PyPI. A package you upload hides PyPI's packages of the same name by default, which prevents dependency confusion attacks.

bandersnatch is the Python Packaging Authority's PyPI mirror client: it syncs PyPI's packages to disk as static files, and any web server can serve them. Run bandersnatch mirror once to create its config file, adjust the config, then run it again to fill the mirror. To mirror only what you use, list projects in an allowlist, which can also read your requirements files.

Whichever you run, set it as pip's index-url, so it replaces PyPI instead of sitting beside it. pip's docs call --extra-index-url for private packages unsafe, since anyone can publish a package with the same name on PyPI. Serve it over HTTPS too, as the Python Packaging User Guide highly recommends.