Merge 490a52eb87 into 03c9a2588f

Updated comments for clarity regarding API access configuration.

.github/workflows/release.yml

@@ -130,12 +130,14 @@ jobs:
             pkg-config \
             curl
 
+      # 💾 cache toolchain
       - uses: actions/cache@v4
         if: matrix.target == 'aarch64-unknown-linux-musl'
         with:
           path: ~/.musl-aarch64
           key: musl-toolchain-aarch64-v1
 
+      # 🔥 надёжная установка
       - name: Install aarch64 musl toolchain
         if: matrix.target == 'aarch64-unknown-linux-musl'
         run: |
@@ -143,19 +145,27 @@ jobs:
 
           TOOLCHAIN_DIR="$HOME/.musl-aarch64"
           ARCHIVE="aarch64-linux-musl-cross.tgz"
-          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
 
           if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
-            echo "✅ MUSL toolchain already installed"
+            echo "✅ musl toolchain already installed"
           else
-            echo "⬇️ Downloading musl toolchain from Telemt GitHub Releases..."
+            echo "⬇️ downloading musl toolchain..."
 
-            curl -fL \
+            download() {
-              --retry 5 \
+              url="$1"
-              --retry-delay 3 \
+              echo "→ trying $url"
-              --connect-timeout 10 \
+              curl -fL \
-              --max-time 120 \
+                --retry 5 \
-              -o "$ARCHIVE" "$URL"
+                --retry-delay 3 \
+                --connect-timeout 10 \
+                --max-time 120 \
+                -o "$ARCHIVE" "$url" && return 0
+              return 1
+            }
+
+            download "https://musl.cc/$ARCHIVE" || \
+            download "https://more.musl.cc/$ARCHIVE" || \
+            { echo "❌ failed to download musl toolchain"; exit 1; }
 
             mkdir -p "$TOOLCHAIN_DIR"
             tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"

config.toml

@@ -39,6 +39,8 @@ port = 443
 enabled = true
 listen = "0.0.0.0:9091"
 whitelist = ["127.0.0.0/8"]
+# Allow API access from Docker bridge subnets
+# whitelist = ["127.0.0.0/8", "172.16.0.0/12"]
 minimal_runtime_enabled = false
 minimal_runtime_cache_ttl_ms = 1000
 

docker-compose.yml

@@ -6,8 +6,8 @@ services:
     restart: unless-stopped
     ports:
       - "443:443"
-      - "127.0.0.1:9090:9090"
+      - "127.0.0.1:9090:9090"   # Metrics
-      - "127.0.0.1:9091:9091"
+      - "127.0.0.1:9091:9091"   # API
     # Allow caching 'proxy-secret' in read-only container
     working_dir: /run/telemt
     volumes:
@@ -29,3 +29,8 @@ services:
       nofile:
         soft: 65536
         hard: 65536
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"