Public Access

T

renwei cdc4e1eee7 Publish the outbound proxy for CI via --print-proxy

Docker only keeps environment variables across RUN steps when they come from ENV or --build-arg, never from variables a script exported in an earlier step. So instead of trying to set the proxy, the script now publishes it: sh smart-mirror.sh --print-proxy emits HTTP_PROXY/HTTPS_PROXY/http_proxy/https_proxy plus NO_PROXY/no_proxy as KEY=value lines, ready to append to GITHUB_ENV and hand to docker build --build-arg.

This makes the proxy a single definition shared by every repository instead of one Gitea secret per repo. Nothing is printed out of office, so callers keep their own defaults there. The address defaults to http://192.168.35.252:7897 (override with SMART_MIRROR_PROXY) and SMART_MIRROR_NO_PROXY is now the one list smart_mirror() also applies on the host, so the two cannot drift.

Tested: dash -n and busybox sh -n pass; a harness built from the real constants/functions plus the real dispatch tail verifies 6 correct lines in office, the SMART_MIRROR_PROXY override, silent behaviour out of office, and that the no-proxy loop appends all six hosts.

2026-10-09 03:57:31 +00:00

README.md

Publish the outbound proxy for CI via --print-proxy

2026-10-09 03:57:31 +00:00

smart-mirror.sh

Publish the outbound proxy for CI via --print-proxy

2026-10-09 03:57:31 +00:00

README.md

Smart Mirror

A simple script to speed up docker build by using mirror sites in China.

How it works

It checks if your are in China office by checking nexus.tdology.com`IP. If yes(a private IP address, but not a public one), It tries to use the mirror sites in China for speeding up the build.

How to use

In your Dockerfile, try to run the script before doing anything, e.g.

FROM alpine:3.18
ADD https://git.piicloud.cn/public/smart-mirror/raw/branch/main/smart-mirror.sh /tmp/smart-mirror.sh
RUN sh /tmp/smart-mirror.sh
ENV no_proxy=nexus.tdology.com,localhost,127.0.0.1
ENV NO_PROXY=nexus.tdology.com,localhost,127.0.0.1

FROM alpine:3.18
RUN curl -fsSL https://git.piicloud.cn/public/smart-mirror/raw/branch/main/smart-mirror.sh | sh

Outbound proxy

Subnets without direct egress (CI runners, some office hosts) need an explicit HTTP(S) proxy. Docker only keeps environment variables across RUN steps when they come from ENV or --build-arg, never from variables a script exported in an earlier step, so the script publishes the proxy instead of setting it:

# in CI, before `docker build`
curl -fsSL "https://git.piicloud.cn/public/smart-mirror/raw/branch/main/smart-mirror.sh?cb=<blob sha>" -o /tmp/smart-mirror.sh
sh /tmp/smart-mirror.sh --print-proxy >> "$GITHUB_ENV"
docker build --build-arg HTTP_PROXY --build-arg HTTPS_PROXY \
             --build-arg http_proxy --build-arg https_proxy \
             --build-arg NO_PROXY --build-arg no_proxy .

--print-proxy prints nothing when the office network is not detected, so callers keep their own defaults off-network. The address defaults to http://192.168.35.252:7897 and can be overridden with SMART_MIRROR_PROXY; the no-proxy list is exactly the one the script also applies on the host (internal services + loopback). As with the Dockerfile ADD, append a ?cb= cache buster to the raw URL so a stale max-age=21600 copy is not reused.

yarn.lock tarball URLs

yarn 1.x downloads from the resolved URL stored in yarn.lock, so pointing yarn at the internal registry is not enough: in office every tarball still comes from whatever public host the lockfile pins. Source the script and rewrite the lockfile in the step that installs dependencies:

ADD https://git.piicloud.cn/public/smart-mirror/raw/branch/main/smart-mirror.sh /tmp/smart-mirror.sh
RUN sh /tmp/smart-mirror.sh && apk add --no-cache git
COPY package.json yarn.lock ./
RUN . /tmp/smart-mirror.sh && smart_mirror_yarn_lock yarn.lock \
    && yarn install --frozen-lockfile

Only the host is rewritten (registry.npmjs.org, registry.yarnpkg.com and registry.npmmirror.com become nexus.tdology.com/repository/npm-group), so the tarball paths and the integrity hashes stay valid. Out of office the helper is a no-op and the lockfile is left untouched.

Prisma engines

In office the Prisma CLI fetches its engine binaries from the internal Nexus raw proxy instead of the public binaries.prisma.sh, so the download stays on the internal network (and off the corporate HTTP proxy). This requires a raw (proxy) repository on Nexus:

Name	Remote storage
`prisma-binaries`	`https://binaries.prisma.sh/`

Prisma appends /all_commits/<hash>/<platform>/<file> to the mirror URL, which is exactly the layout of the remote, so no additional path prefix is needed. Out of office nothing is set and the official CDN is used as before.