From 1de131b1923bf34cf191772a238954ab97075db1 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 29 Sep 2026 00:30:05 +0800 Subject: [PATCH] docs(runbook): note UMT_SUBNET must fall within firewall-allowed range Co-Authored-By: Claude Fable 5.1 --- docs/runbook/deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/runbook/deploy.md b/docs/runbook/deploy.md index 6db1c782..0f4b0cb8 100644 --- a/docs/runbook/deploy.md +++ b/docs/runbook/deploy.md @@ -233,4 +233,4 @@ services: environment: { HTTP_PROXY: http://172.17.0.1:7891, HTTPS_PROXY: http://172.17.0.1:7891, NO_PROXY: localhost,127.0.0.1,app,10.0.0.0/8,172.16.0.0/12 } ``` -防火墙只放行 docker 网段:`ufw allow from 172.16.0.0/12 to 172.17.0.1 port 7891 proto tcp`。Deno 的 fetch 会读 `HTTP(S)_PROXY`/`NO_PROXY`;TMDB、境外 Pi 上游、camofox 访问境外站都经此代理,站内(postgres/camofox)不走代理。 +防火墙只放行 docker 网段:`ufw allow from 172.16.0.0/12 to 172.17.0.1 port 7891 proto tcp`。compose 默认网络已固定在 `UMT_SUBNET`(缺省 172.30.0.0/24,与本机其他网络冲突时在 `.env.deploy` 改成 172.16.0.0/12 内的空闲网段,如 172.16.80.0/24),否则 compose 自动分配的 192.168.x 网段不在放行范围内。Deno 的 fetch 会读 `HTTP(S)_PROXY`/`NO_PROXY`;TMDB、境外 Pi 上游、camofox 访问境外站都经此代理,站内(postgres/camofox)不走代理。