Home Page » News » Tutorials » How to Set Up a Private Offline F‑Droid Repository on Android (No Root)

Set Up a Private Offline F‑Droid Repository on Android (No Root)

10 min read Learn to create a local F‑Droid repository on Android without root, add apps, sign them, and install securely offline. October 07, 2026 20:30

Why Create a Private Offline F‑Droid Repository?

F‑Droid is an open‑source app store that serves only free and open‑source Android applications. By default it pulls packages from the public F‑Droid server, which requires an internet connection and trusts the central signing key. In many situations—air‑gapped environments, corporate devices, or simply a desire to keep a curated set of apps—you may want a repository that lives entirely on your own device or local network. This tutorial shows how to build such a repository without rooting the phone, keeping the process fully under your control.

Before You Start

Android version: 8.0 (Oreo) or newer. The steps rely on the Termux terminal app, which runs on most modern devices.
Storage: At least 1 GB free for the repository and the apps you plan to host.
Network: Wi‑Fi or USB‑tethering is enough; the repository will be served over HTTP on the same device.
Tools: Install Termux from the Play Store or F‑Droid, and the official F‑Droid client.
Basic command‑line comfort: You’ll type a few shell commands, but each is explained.

If you have a PC handy, you can generate the repository there and copy it to the phone later, but the whole workflow can be completed on the device itself.

Step 1 – Install Required Packages in Termux

Open Termux and run the following commands. They install the Python runtime, the fdroidserver toolset, and a tiny HTTP server.

pkg update && pkg upgrade -y
pkg install python git openssl -y
pip install --upgrade pip
pip install fdroidserver

Why this matters: fdroidserver handles metadata creation and signing, while python -m http.server will host the repository locally.

Step 2 – Generate a Repository Signing Key

F‑Droid repositories must be signed with an RSA key. Keep this key safe; anyone who obtains it can inject malicious apps.

cd ~
mkdir repo && cd repo
fdroid init

The fdroid init command creates a repo directory containing a keystore sub‑folder and a default config.py. It also prompts you for a password and some identifying information. Remember the password.

Step 3 – Create the Repository Directory Structure

Inside the repo folder, create the folders that will hold the APKs and the generated metadata.

mkdir -p repo/apks repo/metadata

All APK files you wish to serve must be placed in repo/apks.

Step 4 – Add APKs to the Repository

Copy the desired APKs into the repo/apks directory. You can use the Android file picker, adb push, or Termux’s cp command.

# Example: copy a downloaded APK from Downloads
cp ~/storage/downloads/example-app.apk repo/apks/

Make sure each APK is a genuine, unmodified file. If you obtained the APK from the public F‑Droid server, you can verify its signature later (see the troubleshooting section).

Step 5 – Generate Metadata and Sign the Repository

Run the metadata generation script. This step reads each APK, extracts its manifest, and writes index-v1.json and index-v2.json files.

fdroid update -v

The -v flag shows progress. If the command finishes without error, you will see a repo folder populated with metadata files and a repo index file.

Next, sign the repository so the F‑Droid client trusts it:

fdroid sign

You will be prompted for the keystore password you set earlier. After signing, a file named repo (no extension) appears; this is the signed index the client will download.

Step 6 – Serve the Repository Over HTTP

Start a simple HTTP server from the repo directory. The server will listen on port 8080 by default.

cd repo
python -m http.server 8080

Leave this terminal window open; closing it stops the server. The repository is now reachable at http://127.0.0.1:8080/ (or http://:8080/ if you want another device on the same LAN to access it).

Step 7 – Add the Private Repository to the F‑Droid Client

Open the F‑Droid app.
Tap the three‑dot menu ► Settings.
Scroll to Repositories and tap the + button.
Enter the URL of your local server. For a repository served on the same device, use http://127.0.0.1:8080/. If you are accessing it from another device, replace 127.0.0.1 with the phone’s local IP address (e.g., http://192.168.1.42:8080/).
Tap Add. F‑Droid will download the signed index and verify it against the key you generated.

If the verification succeeds, you’ll see a new section in the app’s main list named after your repository (by default “Local repo”).

Step 8 – Install Apps from Your Private Repository

Refresh the repository by pulling down on the main screen. The apps you placed in repo/apks should now appear. Tap any app, then press Install. The installation proceeds exactly like any other F‑Droid app, using the package manager without root.

After installation, you can verify the signature in Settings ► Apps ► Your App ► App details ► Signature (the exact path varies by manufacturer). It should match the fingerprint of the keystore you created.

Updating the Repository

To add new apps or newer versions, copy the new APKs into repo/apks.
Run fdroid update -v followed by fdroid sign again.
Restart the HTTP server (or simply keep it running; the index file is regenerated in place).
In the F‑Droid client, pull to refresh. New or updated apps will appear with an “Update” button.

Troubleshooting

Repository Not Showing in F‑Droid

Check the URL: Ensure you used http:// (not https://) and the correct port (8080 by default).
Network Access: If you added the repo from another device, verify that the phone’s firewall (e.g., NetGuard) allows inbound connections on port 8080.
Signature Mismatch: If you see “Signature verification failed”, you likely regenerated the keystore after adding the repo. Delete the old entry in F‑Droid Settings ► Repositories and add it again.

“Failed to download index” Error

Make sure the Termux terminal window running python -m http.server is still active.
Confirm that the device is not in a power‑saving mode that disables background network activity.

APK Installation Fails with “Parse error”

The APK may be corrupted or not signed with the same key you used for the repository. Re‑download the APK from a trusted source.
Android 13+ enforces package visibility; ensure the app’s targetSdkVersion is compatible with your device.

Security and Maintenance Tips

Protect the keystore: Back it up to an encrypted location (e.g., a password‑protected zip) and never share the password.
Only host trusted APKs: Even though the repository is private, installing malicious code defeats the purpose of an offline store.
Periodic key rotation: If you suspect the key is compromised, generate a new keystore, re‑sign all APKs, and update the repository URL in clients.
Keep Termux updated: Run pkg upgrade -y regularly to receive security patches for the underlying tools.

With these steps you now have a fully functional, signed, offline F‑Droid repository that works on any Android device without requiring root access. Use it to distribute internal tools, maintain a curated set of privacy‑focused apps, or simply keep a backup of your favorite open‑source software when you’re away from the internet.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.