A debian repos server is simply a folder shared by apache2.

Sample apache2 sites-enabled

<VirtualHost *:80>
  ServerAdmin root@localhost
  DocumentRoot /var/www/myReposRoot
  ServerName reposServer.mydomain.com

  ErrorLog /var/log/apache2/myrepos.error.log

  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn

  CustomLog /var/log/apache2/myrepos.access.log combined

</VirtualHost>


Sample path  needed to put the debian packages

mkdir -p /var/www/myReposRoot/repos/repo1


Oncce the .deb are copied into the repo1 folder: the Packages.gz, Release and Release.pgp needs to be generated.
Release and Release.pgp are only needed to secure the connection  with pgp certificate.

We need a /etc/apt/apt-repo1-release.conf to properly generate a Release file

APT::FTPArchive::Release::Origin "repo1";
APT::FTPArchive::Release::Label "repo1";
APT::FTPArchive::Release::Suite "repo1";
APT::FTPArchive::Release::Codename "repo1";
APT::FTPArchive::Release::Architectures "x64 source";
APT::FTPArchive::Release::Components "main";
APT::FTPArchive::Release::Description "repo1 for debian packages";

 

cd /var/www/myReposRoot/repos
apt-ftparchive packages repo1/ > repo1/Packages
apt-ftparchive -c /etc/apt/apt-repo1-release.conf release repo1/ > repo1/Release
gpg --yes -abs -o  repo1/Release.gpg repo1/Release


Get your gpg key from your server

gpg -a --export > ~/myServerkey
scp ~/myServerkey  user@myclient:.


Repos can be password protected by putting  a .htaccess in /var/www/myReposRoot/repos/repo1
Enable the key on the client

apt-key add myServerkey


Add to your sources.list

deb http://user:pass@myserve.mydomain.com/repos repo1/