feat: docker-compose.yml 镜像引用变量化，setup-env.sh 自动检测中国大陆并换源

- compose 文件镜像引用全部改为 ${CONTAINER_REGISTRY:-ghcr.io}/...
- setup-env.sh 启动时自动检测 ghcr.io 连通性，不可达则提示切换镜像源
- 用户确认后自动写入 CONTAINER_REGISTRY=ghcr.1ms.run 到 .env
- compose 拉取和运行时 docker pull 全部自动走镜像源
- 删除 docker-compose.cn.yml，不再需要单独覆盖文件

Author: ZaneL1u

deploy/scripts/setup-env.sh

@@ -98,6 +98,29 @@ else
   log "将使用外部 PostgreSQL"
 fi
 
+# ── 镜像源检测 ──────────────────────────────────────────────
+
+CONTAINER_REGISTRY=""
+if command -v curl &>/dev/null; then
+  echo ""
+  log "正在检测 ghcr.io 连通性..."
+  if curl -sSf --connect-timeout 5 --max-time 10 "https://ghcr.io" >/dev/null 2>&1; then
+    log "ghcr.io 直接可达"
+  else
+    warn "ghcr.io 不可达（可能在防火墙后），建议使用镜像源 ghcr.1ms.run"
+    echo ""
+    printf "是否将镜像源切换为 ghcr.1ms.run（毫秒镜像）? [Y/n]: "
+    read -r USE_MIRROR
+    USE_MIRROR="${USE_MIRROR:-y}"
+    if [[ "$USE_MIRROR" == "y" || "$USE_MIRROR" == "Y" ]]; then
+      CONTAINER_REGISTRY="ghcr.1ms.run"
+      log "将使用中国大陆镜像源"
+    fi
+  fi
+else
+  warn "未检测到 curl，跳过镜像源检测"
+fi
+
 # ── 控制面和管理员 ──────────────────────────────────────────
 
 echo ""
@@ -148,6 +171,9 @@ ADMIN_USERNAME=${ADMIN_USER}
 ADMIN_PASSWORD=${ADMIN_PASSWORD}
 ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
 
+# Container Registry
+CONTAINER_REGISTRY=${CONTAINER_REGISTRY}
+
 # Logging
 LOG_FORMAT=json
 LOG_LEVEL=info

docker-compose.build.yaml

@@ -3,21 +3,21 @@ services:
     build:
       context: .
       dockerfile: deploy/docker/control-plane/Dockerfile
-    image: ghcr.io/zanel1u/cloud-cli-proxy/control-plane:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/control-plane:latest
     pull_policy: never
 
   admin:
     build:
       context: .
       dockerfile: deploy/docker/admin/Dockerfile
-    image: ghcr.io/zanel1u/cloud-cli-proxy/admin:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/admin:latest
     pull_policy: never
 
   managed-user-image:
     build:
       context: .
       dockerfile: deploy/docker/managed-user/Dockerfile
-    image: ghcr.io/zanel1u/cloud-cli-proxy/managed-user:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/managed-user:latest
     pull_policy: never
     command: ["true"]
     profiles:

docker-compose.cn.yml

@@ -15,7 +15,7 @@ services:
       - cloudproxy-postgres:/var/lib/postgresql
 
   control-plane:
-    image: ghcr.io/zanel1u/cloud-cli-proxy/control-plane:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/control-plane:latest
     pull_policy: always
     restart: unless-stopped
     depends_on:
@@ -31,6 +31,7 @@ services:
       ADMIN_JWT_SECRET: ${ADMIN_JWT_SECRET:?Set ADMIN_JWT_SECRET in .env}
       LOG_FORMAT: ${LOG_FORMAT:-json}
       LOG_LEVEL: ${LOG_LEVEL:-info}
+      CONTAINER_REGISTRY: ${CONTAINER_REGISTRY:-}
     ports:
       - "${SSH_PROXY_PORT:-2222}:2222"
     pid: host
@@ -48,7 +49,7 @@ services:
       start_period: 30s
 
   admin:
-    image: ghcr.io/zanel1u/cloud-cli-proxy/admin:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/admin:latest
     pull_policy: always
     restart: unless-stopped
     depends_on:
@@ -59,14 +60,14 @@ services:
 
   # 预拉取镜像，保持本地缓存。host-agent 通过 docker create 使用此镜像。
   managed-user:
-    image: ghcr.io/zanel1u/cloud-cli-proxy/managed-user:latest
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/zanel1u/cloud-cli-proxy/managed-user:latest
     pull_policy: always
     restart: "no"
     command: ["true"]
 
   # 预拉取探针镜像，供 egress IP 连通性测试使用。
   sing-box:
-    image: ghcr.io/sagernet/sing-box:v1.13.3
+    image: ${CONTAINER_REGISTRY:-ghcr.io}/sagernet/sing-box:v1.13.3
     pull_policy: always
     restart: "no"
     command: ["true"]

docker-compose.yml

@@ -59,38 +59,17 @@ curl http://127.0.0.1:8080/healthz
 
 ## Users in Mainland China
 
-### Option 1: Use docker-compose.cn.yml (recommended)
+`ghcr.io` may be slow or unreachable from within mainland China. `setup-env.sh` auto-detects connectivity and prompts whether to switch to `ghcr.1ms.run` mirror. Accept and it writes the setting to `.env`. Then just `docker compose pull && docker compose up -d`.
 
-The repo includes `docker-compose.cn.yml`, which pre-configures `ghcr.1ms.run` mirror for compose images and sets the `CONTAINER_REGISTRY` environment variable so that runtime image pulls (`managed-user`, `sing-box` probe) also go through the mirror. Start with the override file:
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.cn.yml pull
-docker compose -f docker-compose.yml -f docker-compose.cn.yml up -d
-```
-
-For bare-metal systemd deployments, add to `/etc/cloud-cli-proxy/env`:
+If you already generated `.env`, add this line manually:
 
 ```bash
 CONTAINER_REGISTRY=ghcr.1ms.run
 ```
 
-Restart the control plane. All `docker pull` operations will use the mirror.
-
-Building from source (fallback):
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.cn.yml -f docker-compose.build.yaml --profile build-only build --no-cache
-docker compose -f docker-compose.yml -f docker-compose.cn.yml -f docker-compose.build.yaml up -d --force-recreate
-```
-
-### Option 2: Pull through a local proxy
+This variable controls both compose image pulls and runtime `docker pull` operations (`managed-user` updates, `sing-box` probes). Every `ghcr.io` reference is replaced.
 
-If your machine already has a TUN-mode proxy or global proxy, the default compose file works:
-
-```bash
-docker compose pull
-docker compose up -d
-```
+For bare-metal systemd deployments, add the same line to `/etc/cloud-cli-proxy/env` and restart the control plane.
 
 ## Environment Variables
 

docs/en/guide/deployment.md

@@ -59,38 +59,17 @@ curl http://127.0.0.1:8080/healthz
 
 ## 中国大陆用户
 
-### 方案一：使用 docker-compose.cn.yml（推荐）
+中国大陆访问 `ghcr.io` 可能较慢或不可达。`setup-env.sh` 会自动检测连通性，如果不可达会提示你是否切换到 `ghcr.1ms.run`（毫秒镜像），同意后自动写入 `.env`。直接 `docker compose pull && docker compose up -d` 即可。
 
-项目提供了 `docker-compose.cn.yml`，已将 compose 镜像替换为 `ghcr.1ms.run`（毫秒镜像），同时设置了 `CONTAINER_REGISTRY` 环境变量，确保运行时动态拉取的镜像（`managed-user`、`sing-box` 探针）也走同一镜像源。直接通过覆盖文件启动：
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.cn.yml pull
-docker compose -f docker-compose.yml -f docker-compose.cn.yml up -d
-```
-
-systemd 裸机部署的用户，在 `/etc/cloud-cli-proxy/env` 中加上：
+如果已经生成了 `.env`，手动加上一行：
 
 ```bash
 CONTAINER_REGISTRY=ghcr.1ms.run
 ```
 
-重启控制面后生效。所有 `docker pull` 操作都会自动走镜像源。
-
-源码构建（兜底）：
-
-```bash
-docker compose -f docker-compose.yml -f docker-compose.cn.yml -f docker-compose.build.yaml --profile build-only build --no-cache
-docker compose -f docker-compose.yml -f docker-compose.cn.yml -f docker-compose.build.yaml up -d --force-recreate
-```
-
-### 方案二：走本地代理拉取
+这个变量同时控制 compose 镜像拉取和运行时 `docker pull`（`managed-user` 更新、`sing-box` 探针），所有 `ghcr.io` 引用都会自动替换。
 
-本机已开 TUN 模式或全局代理，镜像走代理出站，直接用默认 compose 文件即可：
-
-```bash
-docker compose pull
-docker compose up -d
-```
+systemd 裸机部署同理，在 `/etc/cloud-cli-proxy/env` 中加上这一行后重启控制面。
 
 ## 环境变量