将构建镜像源切换为阿里云并修复 apt 证书引导失败

默认 DEBIAN/ALPINE 源改为 mirrors.aliyun.com，compose 支持通过环境变量覆盖；构建时先装 ca-certificates，避免 slim 镜像换源后 HTTPS 校验失败。

.env.server.example

@@ -7,6 +7,12 @@ CADDY_SITE_ADDR=https://order.khhao.com
 TZ=Asia/Shanghai
 BACKEND_PORT=3000
 
+# 构建镜像源（可选，默认阿里云公共源）
+# 阿里云 ECS 同地域内网可改为 mirrors.cloud.aliyuncs.com 加速 apt/apk
+# DEBIAN_MIRROR=mirrors.aliyun.com
+# ALPINE_MIRROR=mirrors.aliyun.com
+# NPM_REGISTRY=https://registry.npmmirror.com
+
 # Claim Links
 CLAIM_BASE_URL=https://order.khhao.com/#/claim
 

deploy/docker/backend-dev.Dockerfile

@@ -1,7 +1,8 @@
 # 快手轻量开发镜像：只保留 Node 运行时和基础工具。
 FROM docker.m.daocloud.io/library/node:22-bookworm
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,13 +11,17 @@ ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata \
+       curl tzdata \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone
 

deploy/docker/backend.Dockerfile

@@ -1,7 +1,8 @@
 # 快手轻量后端镜像
 FROM docker.m.daocloud.io/library/node:22-bookworm AS builder
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -9,13 +10,17 @@ ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata
+       curl tzdata
 
 COPY apps/backend/package.json apps/backend/package-lock.json ./
 RUN --mount=type=cache,target=/root/.npm npm ci
@@ -26,7 +31,7 @@ RUN npm run build \
 
 FROM docker.m.daocloud.io/library/node:22-bookworm-slim AS runtime
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Asia/Shanghai
@@ -38,9 +43,12 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata \
+       curl tzdata \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone \
   && apt-get clean \

deploy/docker/frontend.Dockerfile

@@ -16,7 +16,8 @@ RUN npm run build
 
 FROM docker.m.daocloud.io/library/caddy:2-alpine
 
-ARG ALPINE_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg ALPINE_MIRROR=mirrors.cloud.aliyuncs.com
+ARG ALPINE_MIRROR=mirrors.aliyun.com
 
 ENV TZ=Asia/Shanghai
 

docker-compose.dev.yml

@@ -32,6 +32,9 @@ services:
     build:
       context: .
       dockerfile: deploy/docker/backend-dev.Dockerfile
+      args:
+        DEBIAN_MIRROR: ${DEBIAN_MIRROR:-mirrors.aliyun.com}
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
     restart: unless-stopped
     env_file:
       - .env

docker-compose.yml

@@ -30,6 +30,10 @@ services:
     build:
       context: .
       dockerfile: deploy/docker/backend.Dockerfile
+      args:
+        # 默认阿里云公共源；阿里云 ECS 内网可设 DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+        DEBIAN_MIRROR: ${DEBIAN_MIRROR:-mirrors.aliyun.com}
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
     restart: unless-stopped
     env_file:
       - .env
@@ -65,6 +69,8 @@ services:
       dockerfile: deploy/docker/frontend.Dockerfile
       args:
         APP_DOMAIN: ${APP_DOMAIN:-localhost}
+        ALPINE_MIRROR: ${ALPINE_MIRROR:-mirrors.aliyun.com}
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
     restart: unless-stopped
     logging: *json-log-rotation
     depends_on: