Debian 13 (trixie) uses the DEB822 format by default, at /etc/apt/sources.list.d/debian.sources. Debian 12 (bookworm) used it for container images, and older releases use the traditional one-line style at /etc/apt/sources.list. Use whichever section below matches the file your system already has, replacing Debian's default http://deb.debian.org/ with the mirror address.

Debian Buster and above versions support HTTPS sources by default. If you are unable to pull the HTTPS source, please use the HTTP source and install it first:

{{sudo}}apt install apt-transport-https ca-certificates

Traditional format (/etc/apt/sources.list)

# The source mirror is commented out by default to increase the speed of apt update. You can uncomment it if necessary
{{#sid}}
deb {{endpoint}}/ sid main contrib{{#nf}}{{nonfree}}{{/nf}}
{{src}}deb-src {{endpoint}}/ sid main contrib{{#nf}}{{nonfree}}{{/nf}}
{{/sid}}
{{^sid}}
deb {{endpoint}}/ {{release}} main contrib{{#nf}}{{nonfree}}{{/nf}}
{{src}}deb-src {{endpoint}}/ {{release}} main contrib{{#nf}}{{nonfree}}{{/nf}}

deb {{endpoint}}/ {{release}}-updates main contrib{{#nf}}{{nonfree}}{{/nf}}
{{src}}deb-src {{endpoint}}/ {{release}}-updates main contrib{{#nf}}{{nonfree}}{{/nf}}

deb {{endpoint}}/ {{release}}-backports main contrib{{#nf}}{{nonfree}}{{/nf}}
{{src}}deb-src {{endpoint}}/ {{release}}-backports main contrib{{#nf}}{{nonfree}}{{/nf}}

# The following security update software sources include official sources and mirror site configurations. If necessary, you can modify the comments and switch them yourself
deb https://security.debian.org/debian-security {{release}}{{security}} main contrib{{#nf}}{{nonfree}}{{/nf}}
{{src}}deb-src https://security.debian.org/debian-security {{release}}{{security}} main contrib{{#nf}}{{nonfree}}{{/nf}}
{{/sid}}

DEB822 format (/etc/apt/sources.list.d/debian.sources)

{{#sid}}
Types: deb
URIs: {{endpoint}}
Suites: sid
Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

# The source image is commented by default to improve the speed of apt update. You can uncomment it if necessary
{{src}}Types: deb-src
{{src}}URIs: {{endpoint}}
{{src}}Suites: sid
{{src}}Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
{{src}}Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
{{/sid}}
{{^sid}}
Types: deb
URIs: {{endpoint}}
Suites: {{release_deb822}} {{release_deb822}}-updates {{release_deb822}}-backports
Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

# The source image is commented by default to improve the speed of apt update. You can uncomment it if necessary
{{src}}Types: deb-src
{{src}}URIs: {{endpoint}}
{{src}}Suites: {{release_deb822}} {{release_deb822}}-updates {{release_deb822}}-backports
{{src}}Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
{{src}}Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

# The following security update software sources include official sources and mirror site configurations. If necessary, you can modify the comments and switch them yourself
Types: deb
URIs: https://security.debian.org/debian-security
Suites: {{release_deb822}}-security
Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

{{src}}Types: deb-src
{{src}}URIs: https://security.debian.org/debian-security
{{src}}Suites: {{release_deb822}}-security
{{src}}Components: main contrib{{#nf}} non-free non-free-firmware{{/nf}}
{{src}}Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
{{/sid}}

Security updates above point at Debian's official security.debian.org rather than this mirror. That is deliberate, and matches Debian's own guidance: mirrors often lag, and security fixes should arrive as quickly as possible. See the Debian security FAQ.

The purpose of security.debian.org is to make security updates available as quickly and easily as possible.

Encouraging the use of unofficial mirrors would add extra complexity that is usually not needed and that can cause frustration if these mirrors are not kept up to date.

Connection reset by peer

In apt 2.1.9 and later versions, the HTTP Pipelining feature of apt is suspected to be incompatible with the Nginx server, which may cause occasional Connection reset by peer errors when downloading a large number of packages from mirror sites with high bandwidth (such as system upgrades) (see Debian bug #973581 for details).

Currently, users can solve this problem by turning off the HTTP Pipelining feature.
If you need to disable it, you can add the -o Acquire::http::Pipeline-Depth=0 parameter when using the apt command,
or use the following command to add the relevant settings to the apt system configuration:

echo "Acquire::http::Pipeline-Depth \"0\";" > /etc/apt/apt.conf.d/99nopipelining