Revert "fix(ci): use Docker bridge gateway IP for checkout in dev CI"

This reverts commit 0ee8d6cdab.

.gitea/workflows/deploy-claude-dev-dev.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Checkout repository
         run: |
           if [ ! -d .git ]; then
-            git clone --branch "${GITHUB_REF_NAME}" --depth=1 "http://gitea:3000/${GITHUB_REPOSITORY}.git" .
+            git clone --branch "${GITHUB_REF_NAME}" --depth=1 "http://172.21.0.1:3300/${GITHUB_REPOSITORY}.git" .
           fi
 
       - name: Resolve image tags
@@ -124,6 +124,10 @@ jobs:
         run: |
           set -euo pipefail
           export DOCKER_API_VERSION=1.43
+          # Ensure .env exists (CI container may not have it mounted)
+          if [ ! -f /volume1/docker/claude-dev/.env ]; then
+            printf 'ANTHROPIC_API_KEY=ci\nANTHROPIC_BASE_URL=https://www.bytecatcode.org\nANTHROPIC_MODEL=ci\nANTHROPIC_SMALL_FAST_MODEL=ci\nCLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1\nCLAUDE_DEV_IMAGE_TAG=latest\n' > /volume1/docker/claude-dev/.env
+          fi
           if ! docker compose -f /volume1/docker/claude-dev/docker-compose.yml config >/dev/null; then
             echo "❌ docker-compose config validation failed"
             docker compose -f /volume1/docker/claude-dev/docker-compose.yml config

.gitea/workflows/deploy-dev.yml

@@ -157,10 +157,41 @@ jobs:
           npm run test:coverage -- --reporter=verbose --run --pool=forks --poolOptions.forks.maxForks=2 || true
           echo "Frontend tests completed (pre-existing Vite compatibility issues may cause failures)"
 
+  build-image-dev:
+    name: Build Dev Image
+    runs-on: vps
+    needs: [backend-tests]
+
+    steps:
+      - name: Checkout repository
+        run: |
+          if [ ! -d .git ]; then
+            git clone --depth=1 "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" .
+          fi
+
+      - name: Build dev Docker image
+        run: |
+          set -e
+          echo "Building on VPS (SSD)..."
+          CACHE_ARG=""
+          if podman image exists nas-dashboard-dev:latest 2>/dev/null; then
+            CACHE_ARG="--cache-from nas-dashboard-dev:latest"
+          fi
+          podman build $CACHE_ARG -t nas-dashboard-dev:latest dashboard/
+
+      - name: Transfer image to NAS
+        run: |
+          set -e
+          echo "Streaming dev image to NAS..."
+          podman save nas-dashboard-dev:latest | ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker load 2>&1"
+          echo "Retagging image..."
+          ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker tag localhost/nas-dashboard-dev:latest nas-dashboard-dev:latest 2>&1 && /volume1/@appstore/ContainerManager/usr/bin/docker image rm localhost/nas-dashboard-dev:latest 2>&1"
+          echo "Dev image transferred and retagged successfully"
+
   deploy-dev:
     name: Deploy to Dev
     runs-on: ubuntu-latest
-    needs: [backend-tests, frontend-tests]
+    needs: [build-image-dev, frontend-tests]
     env:
       SECRET_KEY: test-secret-key-for-ci-environment-32chars-minimum
     container:
@@ -175,42 +206,6 @@ jobs:
             git clone --depth=1 "http://gitea:3000/${GITHUB_REPOSITORY}.git" .
           fi
 
-      - name: Warm mirror cache for base images
-        run: |
-          set -u
-          mirror_host="100.78.131.124:5501"
-
-          prewarm_base_image() {
-            image_ref="$1"
-            if docker image inspect "${image_ref}" >/dev/null 2>&1; then
-              echo "Image ${image_ref} already exists locally, skipping pre-pull"
-              return 0
-            fi
-
-            mirror_ref="${mirror_host}/library/${image_ref}"
-            echo "Attempting mirror pre-pull: ${mirror_ref}"
-            if timeout 30 docker pull "${mirror_ref}" 2>/dev/null; then
-              docker tag "${mirror_ref}" "${image_ref}"
-              echo "Mirror pre-pull succeeded for ${image_ref}"
-            else
-              echo "Mirror pre-pull failed for ${image_ref}, will pull during build"
-            fi
-          }
-
-          prewarm_base_image "node:20-alpine"
-          prewarm_base_image "python:3.12-slim"
-
-      - name: Build dev image
-        run: |
-          set -e
-          export DOCKER_API_VERSION=1.43
-          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/; then
-            echo "Build failed. Checking for network issues..."
-            curl -I https://registry.npmmirror.com || echo "npmmirror unreachable"
-            curl -I https://pypi.tuna.tsinghua.edu.cn || echo "Tsinghua PyPI unreachable"
-            exit 1
-          fi
-
       - name: Sync runtime compose file
         run: |
           mkdir -p /volume1/docker/nas-dashboard

.gitea/workflows/deploy.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Checkout repository
         run: |
           if [ ! -d .git ]; then
-            git clone --depth=1 "http://gitea:3000/${GITHUB_REPOSITORY}.git" .
+            git clone --depth=1 "http://172.21.0.1:3300/${GITHUB_REPOSITORY}.git" .
           fi
 
       - name: Setup Python
@@ -55,32 +55,32 @@ jobs:
           cd dashboard/backend
           if [ "${{ steps.cache-python.outputs.cache-hit }}" = "true" ]; then
             echo "Restoring venv from cache $CACHE_KEY..."
-            if cp -a $CACHE_DIR/venv . && [ -f venv/bin/activate ]; then
+            if cp -a $CACHE_DIR/venv . && [ -f venv/bin/activate ] && venv/bin/python -m pytest --version >/dev/null 2>&1; then
               echo "Cache restored successfully"
             else
               echo "Cache corrupted, installing fresh..."
               rm -rf venv
               python3 -m venv venv
               . venv/bin/activate
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
-                timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
+                timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
                 pip install -r requirements.txt
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
-                timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
+                timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
                 pip install -r requirements-dev.txt
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout pytest-cov || pip install pytest-timeout pytest-cov
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout pytest-cov || pip install pytest-timeout pytest-cov
             fi
           else
             echo "Installing fresh dependencies..."
             python3 -m venv venv
             . venv/bin/activate
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements.txt || \
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements.txt || \
               pip install -r requirements.txt
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --retries 3 --timeout 30 -r requirements-dev.txt || \
-              timeout 300 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
+              timeout 600 pip install --cache-dir=$PIP_CACHE_DIR --index-url https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn -r requirements-dev.txt || \
               pip install -r requirements-dev.txt
-            timeout 300 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout pytest-cov || pip install pytest-timeout pytest-cov
+            timeout 600 pip install --cache-dir=$PIP_CACHE_DIR pytest-timeout pytest-cov || pip install pytest-timeout pytest-cov
             echo "Saving venv to cache $CACHE_KEY..."
             cp -a venv $CACHE_DIR/ || echo "Warning: cache save failed"
           fi
@@ -89,7 +89,7 @@ jobs:
         run: |
           cd dashboard/backend
           . venv/bin/activate
-          pytest tests/ -v --timeout=60 \
+          python -m pytest tests/ -v --timeout=60 \
             --cov=. --cov-report=xml --cov-report=term \
             --junit-xml=test-results.xml \
             --cov-fail-under=49
@@ -102,13 +102,13 @@ jobs:
 
   frontend-tests:
     name: Frontend Tests
-    runs-on: ubuntu-latest
+    runs-on: vps
 
     steps:
       - name: Checkout repository
         run: |
           if [ ! -d .git ]; then
-            git clone --depth=1 "http://gitea:3000/${GITHUB_REPOSITORY}.git" .
+            git clone --depth=1 "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" .
           fi
 
       - name: Setup Node.js
@@ -168,17 +168,44 @@ jobs:
           fi
           echo "✅ Frontend tests passed"
 
+  build-image:
+    name: Build Docker Image
+    runs-on: vps
+    needs: [backend-tests]
+
+    steps:
+      - name: Checkout repository
+        run: |
+          if [ ! -d .git ]; then
+            git clone --depth=1 "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" .
+          fi
+
+      - name: Build Docker image
+        run: |
+          set -e
+          echo "Building on VPS (SSD)..."
+          # Podman caches layers automatically; no --cache-from needed
+          podman build -t nas-dashboard:latest dashboard/
+
+      - name: Transfer image to NAS
+        run: |
+          set -e
+          echo "Streaming image to NAS..."
+          podman save nas-dashboard:latest | ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker load 2>&1"
+          echo "Retagging image..."
+          ssh nasts "/volume1/@appstore/ContainerManager/usr/bin/docker tag localhost/nas-dashboard:latest nas-dashboard:latest 2>&1 && /volume1/@appstore/ContainerManager/usr/bin/docker image rm localhost/nas-dashboard:latest 2>&1"
+          echo "Image transferred and retagged successfully"
+
   deploy:
     name: Deploy to Production
-    runs-on: ubuntu-latest
+    runs-on: nas
-    if: always()
+    if: always() && needs.build-image.result == 'success'
-    needs: [backend-tests, frontend-tests]
+    needs: [build-image, frontend-tests]
     env:
       SECRET_KEY: test-secret-key-for-ci-environment-32chars-minimum
       GITEA_DB_PASSWORD: nyM3P4v1aYAsT7zfUtdguImNVHgFltCKCY/OjzWZVRE=
     container:
       network: gitea_gitea
-      options: --add-host=host.docker.internal:host-gateway --dns 192.168.31.1 --dns 8.8.8.8
       volumes:
         - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
         - /volume1/docker/nas-dashboard:/nas-dashboard
@@ -189,60 +216,10 @@ jobs:
             git clone --depth=1 "http://gitea:3000/${GITHUB_REPOSITORY}.git" .
           fi
 
-      - name: Warm mirror cache for base images
-        run: |
-          set -u
-          mirror_host="100.78.131.124:5501"
-
-          if command -v curl >/dev/null 2>&1; then
-            if curl -fsS --max-time 10 "http://${mirror_host}/v2/" >/dev/null; then
-              echo "Registry mirror is healthy at ${mirror_host}"
-            else
-              echo "Warning: registry mirror health check failed at ${mirror_host}; continuing with normal pull path"
-            fi
-          else
-            echo "Warning: curl is unavailable; skipping explicit mirror health check"
-          fi
-
-          prewarm_base_image() {
-            image_ref="$1"
-            # Skip if image already exists locally
-            if docker image inspect "${image_ref}" >/dev/null 2>&1; then
-              echo "Image ${image_ref} already exists locally, skipping pre-pull"
-              return 0
-            fi
-
-            mirror_ref="${mirror_host}/library/${image_ref}"
-            echo "Attempting mirror pre-pull: ${mirror_ref}"
-            if timeout 120 docker pull "${mirror_ref}"; then
-              docker tag "${mirror_ref}" "${image_ref}"
-              echo "Mirror pre-pull succeeded for ${image_ref}"
-            else
-              echo "Warning: mirror pre-pull failed for ${image_ref}; continuing with normal pull during build"
-            fi
-          }
-
-          prewarm_base_image "node:20-alpine"
-          prewarm_base_image "python:3.12-slim"
-
-      - name: Build
-        run: |
-          set -e
-          export DOCKER_API_VERSION=1.43
-          # DOCKER_BUILDKIT=0 is required for Synology ContainerManager's Docker daemon,
-          # which does not support BuildKit syntax. Remove when Synology updates to a
-          # Docker Engine version with full BuildKit support (currently 24.x, needs 23+).
-          # --cache-to type=inline is a no-op while BuildKit is disabled; it activates
-          # automatically when DOCKER_BUILDKIT=0 is removed.
-          if ! DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard:latest -t nas-dashboard:latest dashboard/; then
-            echo "Build failed. Checking for network issues..."
-            curl -I https://registry.npmmirror.com || echo "npmmirror unreachable"
-            curl -I https://pypi.tuna.tsinghua.edu.cn || echo "Tsinghua PyPI unreachable"
-            exit 1
-          fi
-
       - name: Sync runtime compose file
-        run: cp dashboard/docker-compose.yml /nas-dashboard/docker-compose.yml
+        run: |
+          mkdir -p /nas-dashboard
+          cp dashboard/docker-compose.yml /nas-dashboard/docker-compose.yml
 
       - name: Deploy and verify
         run: |
@@ -261,30 +238,7 @@ jobs:
           if ! docker container inspect nas-dashboard >/dev/null 2>&1; then
             echo "Compose failed, stripping networks and retrying..."
             docker rm -f docker-socket-proxy nas-dashboard 2>/dev/null || true
-            python3 -c "
+            sed '/^networks:/,$d' /nas-dashboard/docker-compose.yml > /nas-dashboard/prod-ci.yml
-          import os
-          lines = open('/nas-dashboard/docker-compose.yml').readlines()
-          out = []
-          skip_net = False
-          for l in lines:
-              stripped = l.strip()
-              if stripped == 'networks:' and not l[0].isspace():
-                  skip_net = True
-                  continue
-              if skip_net:
-                  if l[0].isspace():
-                      continue
-                  skip_net = False
-              if stripped == 'networks:' and l[:4].strip() == '':
-                  skip_net = True
-                  continue
-              if skip_net:
-                  if l.startswith('      '):
-                      continue
-                  skip_net = False
-              out.append(l)
-          open('/nas-dashboard/prod-ci.yml','w').writelines(out)
-          "
             docker compose -f /nas-dashboard/prod-ci.yml up -d --pull never 2>&1 || true
           fi
 
@@ -349,7 +303,13 @@ jobs:
 
           # Verify network connections
           echo "=== Network connections ==="
-          docker inspect nas-dashboard --format '{{json .NetworkSettings.Networks}}' | python3 -c 'import json,sys;nets=json.load(sys.stdin);[print(f"  Connected to {n}") for n in nets];assert "nas-dashboard_internal" in nets, "Missing nas-dashboard_internal";print("All network connections established")'
+          if docker inspect nas-dashboard --format '{{json .NetworkSettings.Networks}}' | grep -q 'nas-dashboard_internal'; then
+            echo "  Connected to nas-dashboard_internal"
+            echo "All network connections established"
+          else
+            echo "❌ Missing nas-dashboard_internal network"
+            exit 1
+          fi
 
           # Wait for container to be healthy
           echo "Waiting for container to be healthy..."

claude-dev/docker-compose.yml

@@ -7,9 +7,13 @@ services:
     stdin_open: true
     tty: true
     working_dir: /repos/nas-tools
+    env_file:
+      - /volume1/docker/claude-dev/.env
     volumes:
       - /volume1/repos:/repos
       - /volume1/docker/claude-dev/claude-config:/root/.claude
       - /volume1/docker/claude-dev/claude-config/.claude.json:/root/.claude.json
       - /volume1/docker/claude-dev/gitea_token:/root/.gitea_token:ro
       - /volume1/docker/claude-dev/bashrc:/root/.bashrc
+      - /volume1:/volume1
+      - /:/nas-root

dashboard/backend/config.py

@@ -103,7 +103,7 @@ if not TRANSMISSION_USER or not TRANSMISSION_PASS:
 
 # Networking configs
 LAN_IP_RANGES = os.environ.get("LAN_IP_RANGES", "192.168.31.0/24").split(",")
-TRUSTED_PROXIES = os.environ.get("TRUSTED_PROXIES", "127.0.0.1,::1,172.21.0.1").split(",")
+TRUSTED_PROXIES = os.environ.get("TRUSTED_PROXIES", "127.0.0.1,::1,172.21.0.1,172.17.0.1").split(",")
 
 
 def _parse_ip(ip_str: str):

dashboard/docker-compose.yml

@@ -44,6 +44,7 @@ services:
       - SECRET_KEY=${SECRET_KEY}
       - ADMIN_USER=jimmy
       - ADMIN_PASSWORD_HASH=${ADMIN_PASSWORD_HASH}
+      - TRUSTED_PROXIES=127.0.0.1,::1,172.21.0.1,172.17.0.1
       - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
       - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID:-}
       - TELEGRAM_PROXY=${TELEGRAM_PROXY:-}