Is there a reliable way to cache twingate?

[aarontravass]

I have multiple workflows which are either chained or parallelized. Is there a way to cache or set up twingate only once? The startup process takes ages and self hosting is mostly out of the questions.

[linear]

OSS-96

[tonybruess]

It seems like the "sudo apt update" step is the slow part? Surely we can figure out a faster way to start twingate?

[aarontravass]

Even Tailscale has an option to cache binaries https://github.com/tailscale/github-action?tab=readme-ov-file#cache-tailscale-binaries

[yagelrc]

Created github action to cache the packages (twingate/action.yaml). in my tests it takes 12-14 seconds instead of 30-35 seconds.

name: 'Connect to Twingate'
description: 'Connects to Twingate protected resources from your Github Action workflow'
branding:
  icon: 'arrow-right-circle'
  color: 'black'
inputs:
  service-key:
    description: 'Twingate Service Key'
    required: true
  debug:
    description: 'Enable debug output'
    required: false
    default: "false"
  cache:
    description: 'Enable caching of Twingate .deb packages to speed up installation'
    required: false
    default: "true"
runs:
  using: "composite"
  steps:
    - name: Error if unsupported runner.os
      if: runner.os != 'Linux' && runner.os != 'Windows'
      shell: bash
      run: |
        echo "Unsupported Runner OS: ${{ runner.os }}"
        exit 1

    - name: Get Twingate version
      if: runner.os == 'Linux'
      id: twingate-version
      shell: bash
      run: |
        # Get latest version from repository (cache key)
        # Disable exit on error for this command to allow graceful fallback
        set +e
        VERSION=$(curl -sL https://packages.twingate.com/apt/dists/stable/main/binary-amd64/Packages 2>/dev/null | grep -m1 "^Version:" | awk '{print $2}')
        set -e
        
        # If version detection failed, use "unknown" as fallback
        if [ -z "$VERSION" ]; then
          VERSION="unknown"
          echo "⚠️ Could not detect Twingate version, using 'unknown' for cache key"
        else
          echo "✅ Twingate latest version: $VERSION"
        fi
        
        echo "version=$VERSION" >> $GITHUB_OUTPUT

    - name: Restore Twingate packages from cache
      if: runner.os == 'Linux' && inputs.cache == 'true'
      id: cache-twingate
      uses: actions/cache/restore@v4
      with:
        path: /tmp/twingate-packages
        key: twingate-v3-${{ runner.os }}-${{ steps.twingate-version.outputs.version }}

    - name: Install Twingate from cached packages
      if: runner.os == 'Linux' && inputs.cache == 'true' && steps.cache-twingate.outputs.cache-hit == 'true'
      shell: bash
      run: |
        echo "✅ Installing Twingate from cached packages..."
        
        echo "📦 Cached packages:"
        ls -lh /tmp/twingate-packages/
        
        # Install cached .deb packages directly
        LIBNL_DEB=$(ls /tmp/twingate-packages/libnl-route-3-200*.deb 2>/dev/null | head -n1)
        TWINGATE_DEB=$(ls /tmp/twingate-packages/twingate*.deb 2>/dev/null | head -n1)
        
        if [ -f "$LIBNL_DEB" ] && [ -f "$TWINGATE_DEB" ]; then
          echo "📦 Installing packages from cache..."
          sudo dpkg -i "$LIBNL_DEB"
          sudo dpkg -i "$TWINGATE_DEB"
          
          # Fix any dependency issues
          sudo apt-get install -f -yq 2>/dev/null || true
          
          echo "✅ Twingate installed from cache (skipped apt update & download)"
          twingate --version
        else
          echo "⚠️ Cached packages not found, will do full installation"
        fi

    - name: Download Twingate packages
      if: runner.os == 'Linux' && (inputs.cache != 'true' || steps.cache-twingate.outputs.cache-hit != 'true')
      shell: bash
      run: |
        echo "📥 Downloading Twingate packages..."
        
        # Create directory for packages
        mkdir -p /tmp/twingate-packages
        
        # Update apt and add Twingate repository
        sudo apt update
        echo "deb [trusted=yes] https://packages.twingate.com/apt/ /" | sudo tee /etc/apt/sources.list.d/twingate.list
        sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/twingate.list" -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0"
        
        # Download packages to cache directory (don't install yet)
        cd /tmp/twingate-packages
        apt-get download libnl-route-3-200 2>/dev/null || true
        apt-get download twingate 2>/dev/null || true
        cd -
        
        echo "📦 Downloaded packages:"
        ls -lh /tmp/twingate-packages/
    
    - name: Install Twingate packages
      if: runner.os == 'Linux' && (inputs.cache != 'true' || steps.cache-twingate.outputs.cache-hit != 'true')
      shell: bash
      run: |
        echo "📦 Installing Twingate..."
        
        # Install from downloaded packages
        LIBNL_DEB=$(ls /tmp/twingate-packages/libnl-route-3-200*.deb 2>/dev/null | head -n1)
        TWINGATE_DEB=$(ls /tmp/twingate-packages/twingate*.deb 2>/dev/null | head -n1)
        
        if [ -f "$LIBNL_DEB" ] && [ -f "$TWINGATE_DEB" ]; then
          sudo dpkg -i "$LIBNL_DEB"
          sudo dpkg -i "$TWINGATE_DEB"
          
          # Fix any dependency issues
          sudo apt-get install -f -yq 2>/dev/null || true
          
          echo "✅ Twingate installed successfully"
          twingate --version
        else
          echo "⚠️ Package files not found, falling back to apt install"
          sudo apt install -yq twingate
        fi
    
    - name: Save Twingate packages to cache
      if: runner.os == 'Linux' && inputs.cache == 'true' && steps.cache-twingate.outputs.cache-hit != 'true'
      uses: actions/cache/save@v4
      with:
        path: /tmp/twingate-packages
        key: twingate-v3-${{ runner.os }}-${{ steps.twingate-version.outputs.version }}
    
    - name: Setup and start Twingate (Linux)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        echo '${{ inputs.service-key }}' | sudo twingate setup --headless -
        MAX_RETRIES=5
        WAIT_TIME=5
        n=0

        while [ $n -lt $MAX_RETRIES ]; do
          echo "Starting Twingate service..."
          set +xe
          twingate start

          echo "Waiting $WAIT_TIME seconds for Twingate service to start..."
          sleep $WAIT_TIME

          status=$(twingate status)
          echo "Twingate service status: '$status'"

          if [ "$status" = "online" ]; then
            echo "Twingate service is connected."
            if [ "${{ inputs.debug }}" != "false" ]; then
              twingate resources
            fi
            break
          else
            twingate stop
            if [ "${{ inputs.debug }}" != "false" ]; then
              journalctl -u twingate --no-pager
            fi
          fi

          # Increment the retry counter and wait time
          n=$((n+1))
          WAIT_TIME=$((WAIT_TIME+5))

          echo "Twingate service is not connected. Retrying ..."
        done

        if [ $n -eq $MAX_RETRIES ]; then
          echo "Twingate service failed to connect."
          exit 1
        fi

    - name: Install and Start Twingate (Windows)
      if: runner.os == 'Windows'
      shell: powershell
      run: |
          Invoke-WebRequest https://api.twingate.com/download/windows?installer=msi -OutFile .\twingate_client.msi

          Set-Content .\key.json  '${{ inputs.service-key }}'
          $key_path = (Get-Item .\key.json | Resolve-Path).ProviderPath

          Start-Process msiexec.exe -Wait -ArgumentList "/i twingate_client.msi /l*v install.log log_level=debug service_secret=$key_path /quiet"

          Start-Sleep -Seconds 1
          Start-Service twingate.service

          Start-Sleep -Seconds 14
          Get-Service twingate.service

[ekampf]

@yagelrc thanks!
I think the "Get Twingate version" part doesnt work though...
And getting the version properly requires adding the debian source and running apt-get update which would beat the purpose of having cache:

 28 +    - name: Get latest Twingate version
 29 +      if: runner.os == 'Linux' && inputs.cache == 'true'
 30 +      id: twingate-version
 31 +      shell: bash
 32 +      run: |
 33 +        echo "deb [trusted=yes] https://packages.twingate.com/apt/ /" | sudo tee
    +/etc/apt/sources.list.d/twingate.list
 34 +        sudo apt-get update -o Dir::Etc::sourcelist="sources.list.d/twingate.list" -o
    +Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0"
 35 +        VERSION=$(apt-cache policy twingate | grep Candidate | awk '{print $2}')
 36 +        echo "version=$VERSION" >> $GITHUB_OUTPUT
 37 +        echo "Latest Twingate version: $VERSION"

Trying to think if there's a way around this