chore: switch repository links to gitea

backend/internal/service/update_service.go

@@ -22,11 +22,11 @@ import (
 const (
 	updateCacheKey    = "update_check_cache"
 	updateCacheTTL    = 1200 // 20 minutes
-	defaultGitHubRepo = "man209111-cpu/sub2api"
+	defaultGitHubRepo = "kgod/sub2api"
 
 	// Security: allowed download domains for updates
-	allowedDownloadHost = "github.com"
-	allowedAssetHost    = "objects.githubusercontent.com"
+	allowedDownloadHost = "git.jianshixingqiu.com"
+	allowedAssetHost    = "8.138.12.104"
 
 	// Security: max download size (500MB)
 	maxDownloadSize = 500 * 1024 * 1024
@@ -38,7 +38,7 @@ type UpdateCache interface {
 	SetUpdateInfo(ctx context.Context, data string, ttl time.Duration) error
 }
 
-// GitHubReleaseClient 获取 GitHub release 信息的接口
+// GitHubReleaseClient 获取代码仓库 release 信息的接口。
 type GitHubReleaseClient interface {
 	FetchLatestRelease(ctx context.Context, repo string) (*GitHubRelease, error)
 	DownloadFile(ctx context.Context, url, dest string, maxSize int64) error
@@ -81,7 +81,7 @@ type UpdateInfo struct {
 	GitHubRepo     string       `json:"github_repo"`
 }
 
-// ReleaseInfo contains GitHub release details
+// ReleaseInfo contains repository release details
 type ReleaseInfo struct {
 	Name        string  `json:"name"`
 	Body        string  `json:"body"`
@@ -97,7 +97,7 @@ type Asset struct {
 	Size        int64  `json:"size"`
 }
 
-// GitHubRelease represents GitHub API response
+// GitHubRelease represents repository release API response
 type GitHubRelease struct {
 	TagName     string        `json:"tag_name"`
 	Name        string        `json:"name"`
@@ -122,7 +122,7 @@ func (s *UpdateService) CheckUpdate(ctx context.Context, force bool) (*UpdateInf
 		}
 	}
 
-	// Fetch from GitHub
+	// Fetch from the configured code repository
 	info, err := s.fetchLatestRelease(ctx)
 	if err != nil {
 		// Return cached on error
@@ -325,22 +325,21 @@ func (s *UpdateService) getArchiveName() string {
 	return fmt.Sprintf("%s_%s", osName, arch)
 }
 
-// validateDownloadURL checks if the URL is from an allowed domain
-// SECURITY: This prevents SSRF and ensures downloads only come from trusted GitHub domains
+// validateDownloadURL checks if the URL is from an allowed domain.
+// SECURITY: This prevents SSRF and ensures downloads only come from trusted release hosts.
 func validateDownloadURL(rawURL string) error {
 	parsedURL, err := url.Parse(rawURL)
 	if err != nil {
 		return fmt.Errorf("invalid URL: %w", err)
 	}
 
-	// Must be HTTPS
-	if parsedURL.Scheme != "https" {
-		return fmt.Errorf("only HTTPS URLs are allowed")
+	// The self-hosted Gitea instance currently serves releases over HTTP.
+	if parsedURL.Scheme != "https" && parsedURL.Scheme != "http" {
+		return fmt.Errorf("only HTTP(S) URLs are allowed")
 	}
 
 	// Check against allowed hosts
-	host := parsedURL.Host
-	// GitHub release URLs can be from github.com or objects.githubusercontent.com
+	host := parsedURL.Hostname()
 	if host != allowedDownloadHost &&
 		!strings.HasSuffix(host, "."+allowedDownloadHost) &&
 		host != allowedAssetHost &&