fix: mirror header forwarding, auth, cache accounting, and CI build speed - #8
Merged
Conversation
…peed P0 fixes: - ProxyHTTP/ProxyStream now forward client headers (Authorization, Range, Accept) so docker pull, HuggingFace range requests and private registry pulls work through the mirrors - Cap /v2/ registry 401 retry recursion (was unbounded loop on private repos) - Stream cacheable responses to disk instead of buffering with io.ReadAll (avoids OOM on large wheels/tarballs); cache 200 only, never 206 - Rate limiter ignores forged X-Real-IP/X-Forwarded-For unless peer is loopback; fix IPv6 RemoteAddr parsing and IPv6 CIDR defaults - /api/search now requires auth and uses a 10s-timeout client - gitproxy raw/blob URLs no longer carry the extra /raw/ segment (was 404) - 15 mirror handlers read upstream/TTL per request so runtime config changes (hot reload / dashboard edits) take effect P1 fixes: - gitproxy.enabled now actually gates /gh/ and /gl/ routes - Cache usedBytes accounting: scan on startup, decrement on eviction - Constant-time login comparison + login endpoint rate limited - /api/config/public requires auth - Frontend: search pagination (has_more), per_page param, Settings rate save, 401 redirect, router/client circular import, login redirect, catch-all 404 route, full vite dev proxy list - Align compose/README image refs to ghcr.io/wha7ev9r/devbox - Remove dead assets (icons.svg, vue.svg, vite.svg, hero.png, package-lock.json), bump favicon cache version CI: - Dockerfile: build frontend once on BUILDPLATFORM, cross-compile Go for TARGETARCH (no QEMU emulation), BuildKit cache mounts (expected multi-arch build time ~8min -> ~3-4min)
…ew favicon Review fixes: - ProxyHTTP spools to a unique temp file per request (os.CreateTemp) so concurrent misses on the same key can no longer interleave writes and corrupt cache entries; ScanSize/evictLRU skip .tmp-* files - Authenticated requests (Authorization header) bypass shared cache read/write entirely — URL-only keys would otherwise leak one client's authenticated responses to everyone (e.g. /ghapi/ with a PAT) - Strip hop-by-hop headers (Connection, Transfer-Encoding, Upgrade, Proxy-Authorization, ...) when forwarding to upstreams, in both mirror.Cache and gitproxy - Rate limiter trusts X-Real-IP / X-Forwarded-For only from peers within configurable rate_limit.trusted_proxies CIDRs (loopback by default), fixing the Docker + host-nginx deployment where peers appear as the bridge gateway; New() falls back to loopback defaults when unset Icon: - New favicon: isometric purple gradient box with cyan terminal prompt (>_), radial dark panel, glass highlight, soft shadow (v3 cache bump) - Header logo upgraded from text badge to inline SVG cube + wordmark
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
围绕三个问题：docker pull 镜像代理不可用、dashboard 部分功能失效、CI 双平台构建耗时 ~8min。
高优先级修复（P0）
ProxyHTTP/ProxyStream现在转发Authorization/Range/Accept等头（原只透传 path/query），docker pull（含私有镜像）、HuggingFace Range 断点续传从此可用/v2/registry 401 无限递归：加深度限制（>2 次即返回 401），私有仓库/scope 错误不再死循环io.ReadAll全量缓冲 OOM 风险：可缓存响应改为流式写入临时文件 + 原子 rename；且只缓存 200（206 部分内容绝不入缓存）X-Real-IP/X-Forwarded-For仅在连接方为回环地址（本机反代）时信任；顺手修复 IPv6RemoteAddr解析与 IPv6 CIDR 默认前缀/api/search未鉴权 + 无超时：补鉴权，统一走 10s 超时专用 client/raw/段已移除（新增路径断言测试）ProxyHandler改为每次请求读取 upstream/TTL（与 npm/docker 一致）中优先级修复（P1）
gitproxy.enabled配置项真正生效（为 false 时不注册/gh//gl/路由）usedBytes记账：启动扫描磁盘初始化、删除/淘汰时扣减（max_size 限定额失效问题）/api/）/api/config/public补鉴权has_more字段）、per_page参数失效、Settings rate 保存必 400、401 跳转登录、client/router 循环依赖、已登录可访问 /login、无 404 路由ghcr.io/wha7ev9r/devbox（原指向 ksbbs 旧仓库，导致拉不到新版本）Docker 构建优化
多阶段构建重构：前端仅构建一次（
--platform=$BUILDPLATFORM，静态产物无架构差异），Go 交叉编译（CGO_ENABLED=0+$TARGETARCH，免 QEMU），runtime 按目标平台拉基础镜像，另加 BuildKit cache mount（pnpm store / GOMODCACHE / GOCACHE）。预计双平台构建 8min → 3-4min，需 CI 实测确认。验证
go build ./.../go vet ./.../go test ./...全部通过（新增 ratelimit、gitproxy 测试）pnpm run build（vue-tsc + vite）通过