fix(build): configure Docker pip mirrors with locked fallback [skip ci]

2026-10-09 00:02:09 +08:00
parent 32229609c9
commit b9b33b83bb
7 changed files with 64 additions and 7 deletions
@@ -69,3 +69,20 @@ Publish a non-retained JSON message to the configured command topic:
 ```

 Replies appear on `<topic>/result` with operation_id or the standard error object. Poll the REST Operation API for completion. QoS duplicate messages with the same request_id cannot repeat the operation; retained commands are rejected. Automatic broker reconnection never re-sends frame writes. No broker is started or required for ordinary NAS operation.
+
+### Docker dependency downloads
+
+Docker builds use `DOCKER_PIP_INDEX_URL` (default: Tsinghua PyPI mirror) and
+`DOCKER_PIP_FALLBACK_INDEX_URL` (default: official PyPI). Configure these as
+Gitea Variables for both Verify and production deployment. These public mirror
+URLs must not contain credentials; build arguments are visible in build metadata.
+CI tooling separately uses `CI_PIP_INDEX_URL` and `CI_PIP_FALLBACK_INDEX_URL`.
+A failed mirror installation retries the same locked requirements against the
+fallback, without extra indexes, version downgrades, or disabling build isolation.
+Logs show index hosts and redact URL credentials/query parameters.
+
+APT/font layers remain cached when Python dependencies change. The Python layer
+changes only when the lock, installer, base image, or mirror arguments change;
+application source changes reuse it. BuildKit pip cache survives layer misses.
+An explicitly supplied, checksum-verified offline wheel directory still takes
+precedence and never falls back to the network.