# pip → cache frontend via pypi.org/files.pythonhosted.org (mapped by
# extra_hosts); not `package-cache`, which coredns can't resolve.
# trusted-host skips the frontend's self-signed cert.
[global]
index-url = https://pypi.org/simple/
trusted-host =
    pypi.org
    files.pythonhosted.org