chore(deploy): NO_PROXY defaults for downloaders; explain library root modes

- compose: app gets a default NO_PROXY (UMT_NO_PROXY) listing compose
  service names incl. qbittorrent / qbittorrent-nox / qb / transmission /
  deluge / aria2, so a proxy override never swallows downloader traffic.
- runbook: proxy and test-qB override templates use the same list.
- Settings: one-line hint on library root "管理方式" (managed vs
  register_only).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/settings/instances.tsx

@@ -347,6 +347,8 @@ export function LibraryRootsTable() {
               { value: "register_only", label: "只登记" },
               { value: "managed", label: "自动维护（补齐、升级）" },
             ],
+            hint: "自动维护：自动整理可把新下载放进来，文件管理可在其中改名、移动、删除；只登记：只扫描登记已有文件，不自动写入也不可改动。",
+            wide: true,
           },
           { name: "enabled", label: "启用", kind: "switch" },
           { name: "notes", label: "备注", kind: "textarea" },

docker-compose.yml

@@ -188,6 +188,10 @@ services:
       BROWSER_ENABLED: ${BROWSER_ENABLED:-true}
       # 原站视图桌面模式的上游(桌面镜像的 Selkies);缺省由 BROWSER_PROVIDER_URL 推出(端口换 3000)
       BROWSER_DESKTOP_URL: ${BROWSER_DESKTOP_URL:-}
+      # 出站代理(HTTP_PROXY/HTTPS_PROXY)在 override 里给(见 docs/runbook/deploy.md「容器经宿主代理」)。
+      # Deno 按主机名匹配 NO_PROXY、不会因解析到内网 IP 而直连:同 compose 网络的服务名(postgres、camofox、
+      # 下载器 qbittorrent 等)必须列在这里,否则连下载器也会绕到代理上失败。自有下载器服务名不同就改 UMT_NO_PROXY。
+      NO_PROXY: ${UMT_NO_PROXY:-localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
     ports:
       - "${UMT_BIND:-0.0.0.0}:${UMT_PORT:-4380}:4380"
     volumes:

docs/runbook/deploy.md

@@ -228,11 +228,14 @@ services:
     environment:
       HTTP_PROXY: http://172.17.0.1:7891
       HTTPS_PROXY: http://172.17.0.1:7891
-      NO_PROXY: localhost,127.0.0.1,postgres,camofox,proxy-relay,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+      # 同网络的服务名都要列上(含下载器:qbittorrent / transmission / deluge / aria2 等),与 compose 缺省 UMT_NO_PROXY 一致
+      NO_PROXY: localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
   camofox:
     environment: { HTTP_PROXY: http://172.17.0.1:7891, HTTPS_PROXY: http://172.17.0.1:7891, NO_PROXY: localhost,127.0.0.1,app,10.0.0.0/8,172.16.0.0/12 }
 ```
 
+compose 已给 app 设了缺省 `NO_PROXY`(`UMT_NO_PROXY` 可改),override 里重写 `NO_PROXY` 时别漏掉下载器的服务名。
+
 防火墙只放行 docker 网段:`ufw allow from 172.16.0.0/12 to 172.17.0.1 port 7891 proto tcp`。compose 默认网络已固定在 `UMT_SUBNET`(缺省 172.30.0.0/24,与本机其他网络冲突时在 `.env.deploy` 改成 172.16.0.0/12 内的空闲网段,如 172.16.80.0/24),否则 compose 自动分配的 192.168.x 网段不在放行范围内。Deno 的 fetch 会读 `HTTP(S)_PROXY`/`NO_PROXY`;TMDB、境外 Pi 上游、camofox 访问境外站都经此代理,站内(postgres/camofox)不走代理。
 
 ## 测试用 qB(override 示例)
@@ -244,7 +247,7 @@ services:
   app:
     environment:
       # 配了 HTTP(S)_PROXY 时必须把 qbittorrent 加进 NO_PROXY:Deno 按主机名匹配,不会因解析到内网 IP 而直连
-      NO_PROXY: localhost,127.0.0.1,postgres,camofox,proxy-relay,qbittorrent,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+      NO_PROXY: localhost,127.0.0.1,::1,postgres,camofox,proxy-relay,qbittorrent,qbittorrent-nox,qb,transmission,deluge,aria2,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
   qbittorrent:
     image: lscr.io/linuxserver/qbittorrent:5.2.4   # v4 / 5.0–5.2 都兼容(QB-1 实测 5.1.2、5.2.4)
     restart: unless-stopped