We had multiple guides on setting up our own paclet server:
It's easy to do I tried it and works well.
One remaining question I have: will paclets installed from a paclet site update automatically in the background, without an explicit PacletUpdate? If yes, how often? How could a user detect that an update took place? Can updates be disabled/enabled for one site only, without affecting the main WRI paclet site?
All this is also related to security. Running a paclet site is a responsibility. What if it gets hacked and someone puts malicious code there? This is an even bigger problem if updates are fully automatic.
Hosting my packages on my own paclet server is tempting, but I am not yet sure if it's a good idea. This stuff is still undocumented. I am not sure what can go wrong. There are the auto-updates (maybe). Security concerns. The fact that paclet functions clearly aren't end-user oriented: what if somebody accidentally removes the WRI paclet server after he reads about PacletSiteRemove in some package's installation instructions? Because of some of the support emails I get, I believe in Murphy's laws more than ever.
Related:
