fix(relay): route China deploys through mirrors

src/apps/desktop/src/api/relay_deploy_api.rs

@@ -11,7 +11,7 @@
 //! `src/web-ui/src/features/relay-deploy/README.md`.
 
 use bitfun_core::service::remote_ssh::relay_deploy::{
-    self, RelayDeployTask, RelayPreflight, RelayTaskPoll, RelayTaskStart,
+    self, RelayDeployTask, RelayMirrorMode, RelayPreflight, RelayTaskPoll, RelayTaskStart,
 };
 use serde::Serialize;
 use tauri::State;
@@ -39,14 +39,21 @@ pub async fn relay_deploy_preflight(
 pub async fn relay_deploy_install_docker(
     state: State<'_, AppState>,
     connection_id: String,
+    mirror_mode: Option<RelayMirrorMode>,
 ) -> Result<RelayTaskStart, String> {
     let manager = state
         .get_ssh_manager_async()
         .await
         .map_err(|e| e.to_string())?;
-    relay_deploy::start_task(&manager, &connection_id, RelayDeployTask::InstallDocker, 0)
-        .await
-        .map_err(|e| e.to_string())
+    relay_deploy::start_task(
+        &manager,
+        &connection_id,
+        RelayDeployTask::InstallDocker,
+        0,
+        mirror_mode.unwrap_or_default(),
+    )
+    .await
+    .map_err(|e| e.to_string())
 }
 
 /// Stage the interactive deploy driver (run it in a remote PTY; poll via
@@ -56,6 +63,7 @@ pub async fn relay_deploy_start(
     state: State<'_, AppState>,
     connection_id: String,
     port: Option<u16>,
+    mirror_mode: Option<RelayMirrorMode>,
 ) -> Result<RelayTaskStart, String> {
     let manager = state
         .get_ssh_manager_async()
@@ -66,6 +74,7 @@ pub async fn relay_deploy_start(
         &connection_id,
         RelayDeployTask::Deploy,
         port.unwrap_or(0),
+        mirror_mode.unwrap_or_default(),
     )
     .await
     .map_err(|e| e.to_string())

src/apps/relay-server/Dockerfile

@@ -61,8 +61,9 @@ RUN set -eux; \
         > /usr/local/cargo/config.toml; \
     fi
 
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
+RUN apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 \
+      install -y --no-install-recommends \
         pkg-config \
         build-essential \
         ca-certificates \
@@ -145,8 +146,9 @@ RUN set -eux; \
           /etc/apt/sources.list.d/debian.sources; \
       fi; \
     fi; \
-    apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates curl \
+    apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 \
+      install -y --no-install-recommends ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

src/apps/relay-server/README.md

@@ -41,7 +41,9 @@ RELAY_CARGO_BUILD_JOBS=1 bash deploy.sh
 `deploy.sh` (and Desktop one-click deploy) auto-detects mainland China and
 configures host mirrors for apt, Docker Hub, and GitHub source retrieval plus
 a build-local Cargo/crates.io mirror. Docker Engine installation also uses a
-mainland mirror. Override when needed:
+mainland mirror. The Desktop wizard also offers **Auto / Mainland China /
+Global** so an operator can override cloud IP geolocation without editing the
+server environment. Override manual deploys when needed:
 
 ```bash
 BITFUN_MIRROR=cn bash deploy.sh          # force China mirrors
@@ -60,7 +62,9 @@ for the full list (`BITFUN_APT_MIRROR`, `BITFUN_DOCKER_REGISTRY_MIRRORS`,
 China mode does not modify the SSH user's global `~/.cargo/config.toml`; Cargo
 mirroring is scoped to the relay image build. Switching to `global` restores
 apt files disabled by BitFun and removes only Docker registry mirrors recorded
-as BitFun additions.
+as BitFun additions. The published-binary runtime image receives the same
+choice as build args: Docker daemon mirrors cover the base-image pull, while
+the apt mirror separately covers packages installed inside the image.
 
 `deploy.sh` enables Docker BuildKit so the Dockerfile can reuse Cargo
 registry/git/`target` cache mounts across redeploys. Keep BuildKit enabled

src/apps/relay-server/mirror.sh

@@ -18,6 +18,8 @@
 #
 # Sets / exports (when mode=cn):
 #   BITFUN_MIRROR_MODE=cn|global
+#   BITFUN_MIRROR_REQUESTED_MODE=auto|cn|global
+#   BITFUN_MIRROR_REASON=<human-readable-resolution-reason>
 #   BITFUN_USE_CN_MIRROR=0|1
 #   BITFUN_GITHUB_GIT_URL / BITFUN_GITHUB_TARBALL_URL
 #   BITFUN_DOCKER_GET_URL
@@ -217,27 +219,34 @@ bitfun_mirror_resolve_mode() {
   forced="$(echo "$forced" | tr '[:upper:]' '[:lower:]')"
   case "$forced" in
     cn|china|zh|zh-cn|zh_cn|1|true|yes)
+      export BITFUN_MIRROR_REQUESTED_MODE=cn
       export BITFUN_MIRROR_MODE=cn
+      export BITFUN_MIRROR_REASON=forced-cn
       export BITFUN_USE_CN_MIRROR=1
       return 0
       ;;
     global|intl|international|off|0|false|no|overseas)
+      export BITFUN_MIRROR_REQUESTED_MODE=global
       export BITFUN_MIRROR_MODE=global
+      export BITFUN_MIRROR_REASON=forced-global
       export BITFUN_USE_CN_MIRROR=0
       return 0
       ;;
   esac
+  export BITFUN_MIRROR_REQUESTED_MODE=auto
 
   # Already resolved in this shell (or exported by the caller). Detection costs
   # up to four HTTP lookups plus two 4s probes, and mirror.sh is initialised at
   # several points of one deploy; re-running it there is both slow and unstable,
   # because a network blip mid-deploy could flip the mode between steps.
   case "${BITFUN_MIRROR_MODE:-}" in
     cn)
+      export BITFUN_MIRROR_REASON="${BITFUN_MIRROR_REASON:-cached-cn}"
       export BITFUN_USE_CN_MIRROR=1
       return 0
       ;;
     global)
+      export BITFUN_MIRROR_REASON="${BITFUN_MIRROR_REASON:-cached-global}"
       export BITFUN_USE_CN_MIRROR=0
       return 0
       ;;
@@ -248,6 +257,7 @@ bitfun_mirror_resolve_mode() {
   if [ "$country" = "CN" ]; then
     echo ">>> Region detect: public IP country=CN → China mirrors"
     export BITFUN_MIRROR_MODE=cn
+    export BITFUN_MIRROR_REASON=public-ip-cn
     export BITFUN_USE_CN_MIRROR=1
     return 0
   fi
@@ -260,26 +270,30 @@ bitfun_mirror_resolve_mode() {
   if [ -n "$country" ]; then
     echo ">>> Region detect: public IP country=${country} → global mirrors"
     export BITFUN_MIRROR_MODE=global
+    export BITFUN_MIRROR_REASON="public-ip-${country}"
     export BITFUN_USE_CN_MIRROR=0
     return 0
   fi
 
   if bitfun_mirror_timezone_suggests_cn; then
     echo ">>> Region detect: timezone suggests mainland China → China mirrors"
     export BITFUN_MIRROR_MODE=cn
+    export BITFUN_MIRROR_REASON=timezone-cn
     export BITFUN_USE_CN_MIRROR=1
     return 0
   fi
 
   if bitfun_mirror_connectivity_suggests_cn; then
     echo ">>> Region detect: GitHub unreachable + Aliyun reachable → China mirrors"
     export BITFUN_MIRROR_MODE=cn
+    export BITFUN_MIRROR_REASON=connectivity-cn
     export BITFUN_USE_CN_MIRROR=1
     return 0
   fi
 
   echo ">>> Region detect: inconclusive → global mirrors"
   export BITFUN_MIRROR_MODE=global
+  export BITFUN_MIRROR_REASON=inconclusive-global
   export BITFUN_USE_CN_MIRROR=0
   return 0
 }
@@ -1224,7 +1238,7 @@ bitfun_mirror_init() {
   bitfun_mirror_parse_args "$@"
   bitfun_mirror_resolve_mode
   bitfun_mirror_export_urls
-  echo ">>> Mirror mode: ${BITFUN_MIRROR_MODE} (BITFUN_USE_CN_MIRROR=${BITFUN_USE_CN_MIRROR})"
+  echo ">>> Mirror mode: ${BITFUN_MIRROR_MODE} (requested=${BITFUN_MIRROR_REQUESTED_MODE:-auto}, reason=${BITFUN_MIRROR_REASON:-unknown}, BITFUN_USE_CN_MIRROR=${BITFUN_USE_CN_MIRROR})"
   if [ "${BITFUN_MIRROR_MODE}" = "cn" ]; then
     echo ">>> GitHub git URL:     ${BITFUN_GITHUB_GIT_URL}"
     echo ">>> GitHub tarball URL: ${BITFUN_GITHUB_TARBALL_URL}"

src/apps/relay-server/release-download.sh

@@ -19,6 +19,9 @@
 #   BITFUN_OPENBITFUN_RELEASE_BASE  https://openbitfun.com/release
 #   BITFUN_GITHUB_PROXY             prefix-style proxy, set by mirror.sh in CN
 #   BITFUN_MIRROR_MODE              cn | global, set by mirror.sh
+#   BITFUN_USE_CN_MIRROR            1 switches apt inside the runtime image
+#   BITFUN_APT_MIRROR               Debian mirror host (default mirrors.aliyun.com)
+#   BITFUN_RUNTIME_BASE             runtime base image (default debian:trixie-slim)
 #   RELAY_PORT                      published port (default 9700)
 #   RELAY_HOST_BIND_IP              bind address (default 0.0.0.0, as compose)
 #
@@ -129,6 +132,24 @@ bitfun_canonical_checksum_url() {
 # source-build path that follows.
 bitfun_build_runtime_image() {
   local image="$1" context="$2" rc=1
+  local use_cn_mirror="${BITFUN_USE_CN_MIRROR:-0}"
+  local apt_mirror="${BITFUN_APT_MIRROR:-mirrors.aliyun.com}"
+  local runtime_base="${BITFUN_RUNTIME_BASE:-debian:trixie-slim}"
+
+  # The Docker daemon's registry-mirrors accelerate the FROM pull. These build
+  # args are a separate, equally necessary hop: apt runs *inside* the temporary
+  # runtime image and cannot see the host's /etc/apt sources. Losing these args
+  # made correctly detected CN hosts still contact deb.debian.org here.
+  local build_args=(
+    --build-arg "BITFUN_USE_CN_MIRROR=${use_cn_mirror}"
+    --build-arg "BITFUN_APT_MIRROR=${apt_mirror}"
+    --build-arg "BITFUN_RUNTIME_BASE=${runtime_base}"
+  )
+  if [ "$use_cn_mirror" = "1" ]; then
+    echo ">>> Runtime image network route: China (apt=${apt_mirror}; Docker registry mirrors are daemon-managed)"
+  else
+    echo ">>> Runtime image network route: global (official Debian apt and image registry)"
+  fi
 
   # A config dir this user definitely owns. Empty if it cannot be created, in
   # which case the retries keep the inherited DOCKER_CONFIG.
@@ -158,7 +179,7 @@ bitfun_build_runtime_image() {
           export DOCKER_BUILDKIT=0
           ;;
       esac
-      bitfun_docker build -t "$image" "$context"
+      bitfun_docker build "${build_args[@]}" -t "$image" "$context"
     ); then
       rc=0
       break
@@ -406,10 +427,27 @@ bitfun_try_release_deploy() {
   # every release a client in the wild might still install. trixie-slim carries
   # glibc 2.41 and covers both 2.38 and 2.35.
   cat >"$context.new/Dockerfile" <<'DOCKERFILE'
-FROM debian:trixie-slim
+ARG BITFUN_RUNTIME_BASE=debian:trixie-slim
+FROM ${BITFUN_RUNTIME_BASE}
+ARG BITFUN_USE_CN_MIRROR=0
+ARG BITFUN_APT_MIRROR=mirrors.aliyun.com
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates curl \
+RUN set -eux; \
+    if [ "${BITFUN_USE_CN_MIRROR}" = "1" ]; then \
+      sed -i \
+        -e "s|deb.debian.org/debian|${BITFUN_APT_MIRROR}/debian|g" \
+        -e "s|security.debian.org/debian-security|${BITFUN_APT_MIRROR}/debian-security|g" \
+        /etc/apt/sources.list 2>/dev/null || true; \
+      if [ -f /etc/apt/sources.list.d/debian.sources ]; then \
+        sed -i \
+          -e "s|deb.debian.org/debian|${BITFUN_APT_MIRROR}/debian|g" \
+          -e "s|security.debian.org/debian-security|${BITFUN_APT_MIRROR}/debian-security|g" \
+          /etc/apt/sources.list.d/debian.sources; \
+      fi; \
+    fi; \
+    apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 update \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 \
+      install -y --no-install-recommends ca-certificates curl \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY bitfun-relay-server relay-admin /app/