update docs

docs/src/content/docs/deployment/architecture.mdx

@@ -3,7 +3,7 @@ title: 推荐部署架构
 description: 公网部署 HubProxy 的推荐拓扑与安全要求。
 ---
 
-公网服务时，推荐始终通过反向代理暴露 HubProxy，而不是将 `5000` 端口直接暴露到公网。
+公网服务建议通过反向代理暴露 HubProxy，保障服务器安全。
 
 ## 推荐拓扑
 
@@ -17,12 +17,13 @@ description: 公网部署 HubProxy 的推荐拓扑与安全要求。
 | 反向代理 | 终止 TLS、写入真实客户端 IP、隐藏后端端口 |
 | HubProxy | 处理 Docker/GitHub 代理逻辑 |
 
-## 必须满足的条件
+## 反代部署时的要求
 
-1. **反代覆盖写** `X-Forwarded-For` / `X-Real-IP`（不要 append 客户端自带头）
+若采用上文推荐拓扑（用户 → 反代 → HubProxy），需满足：
-2. **5000 不对公网开放**，仅允许反代访问
+
-3. 公网服务建议配置 `[access].whiteList` 限制可代理的仓库
+1. **反代覆盖写** `X-Forwarded-For` / `X-Real-IP`（防止用户伪造 IP，勿 append 客户端自带头）
-4. 反代覆盖写 `X-Forwarded-Host`（防止 `.sh` 脚本 Host 注入）
+2. **建议 5000 仅对反代可达**（绑定 `127.0.0.1` 或防火墙限制）
+3. 反代覆盖写 `X-Forwarded-Host`（防止 `.sh` 脚本 Host 注入）
 
 ## 各场景对照
 

docs/src/content/docs/en/deployment/architecture.mdx

@@ -3,7 +3,7 @@ title: Recommended Architecture
 description: Recommended topology and security requirements for public HubProxy deployments.
 ---
 
-For public-facing deployments, always expose HubProxy through a reverse proxy instead of publishing port `5000` directly.
+For public deployments, a reverse proxy in front of HubProxy is recommended to keep the server secure.
 
 ## Recommended Topology
 
@@ -17,12 +17,13 @@ Users → CDN (optional) → Caddy/Nginx (private/local) → HubProxy:5000
 | Reverse proxy | TLS, real client IP injection, hide backend port |
 | HubProxy | Docker/GitHub proxy logic |
 
-## Requirements
+## Requirements When Using a Reverse Proxy
 
-1. Reverse proxy must **overwrite** `X-Forwarded-For` / `X-Real-IP` (never append client-supplied headers)
+If you follow the recommended topology above (users → proxy → HubProxy):
-2. Port **5000 must not be public** — only the reverse proxy should reach it
+
-3. Configure `[access].whiteList` for public services to restrict proxied registries
+1. Reverse proxy must **overwrite** `X-Forwarded-For` / `X-Real-IP` (prevent client IP spoofing — never append client-supplied headers)
-4. Overwrite `X-Forwarded-Host` to prevent Host injection in `.sh` scripts
+2. **Preferably make port 5000 reachable only by the proxy** (bind `127.0.0.1` or firewall)
+3. Overwrite `X-Forwarded-Host` to prevent Host injection in `.sh` scripts
 
 ## Scenario Comparison
 

docs/src/content/docs/en/guides/github-proxy.mdx

@@ -27,22 +27,20 @@ curl "https://example.com/https://api.github.com/repos/owner/repo/releases/lates
 Use `url.<base>.insteadOf` so every `https://github.com/` clone/fetch goes through HubProxy automatically:
 
 ```bash
-git config --global url."https://example.com//https://github.com/".insteadOf "https://github.com/"
+git config --global url."https://example.com/https://github.com/".insteadOf "https://github.com/"
 ```
 
 Then clone as usual:
 
 ```bash
 git clone https://github.com/owner/repo.git
-# actually requests https://example.com//https://github.com/owner/repo.git
+# actually requests https://example.com/https://github.com/owner/repo.git
 ```
 
-HubProxy normalizes extra leading slashes in the path — this is equivalent to a single-slash prefix form.
-
 To remove:
 
 ```bash
-git config --global --unset url.https://example.com//https://github.com/.insteadOf
+git config --global --unset url.https://example.com/https://github.com/.insteadOf
 ```
 
 ### Omit `https://`

docs/src/content/docs/en/security/overview.mdx

@@ -31,7 +31,7 @@ HubProxy has **no** admin login, Basic Auth, API keys, or Prometheus `/metrics`.
 - Use [Recommended Architecture](/en/deployment/architecture/): CDN (optional) → reverse proxy → HubProxy
 - Configure `[access].whiteList` for public services
 - Overwrite `X-Forwarded-For`, `X-Real-IP`, and `X-Forwarded-Host` at the proxy
-- Do not expose port 5000 to the public internet
+- Expose public services through a reverse proxy instead of port 5000 directly
 - Review `[access].blackList` and access logs regularly
 
 ## Related Docs

docs/src/content/docs/guides/github-proxy.mdx

@@ -27,22 +27,20 @@ curl "https://example.com/https://api.github.com/repos/owner/repo/releases/lates
 配置 `url.<base>.insteadOf` 后，所有 `https://github.com/` 开头的 clone/fetch 会自动走 HubProxy，无需每次手动改 URL：
 
 ```bash
-git config --global url."https://example.com//https://github.com/".insteadOf "https://github.com/"
+git config --global url."https://example.com/https://github.com/".insteadOf "https://github.com/"
 ```
 
 之后可直接：
 
 ```bash
 git clone https://github.com/owner/repo.git
-# 实际请求 https://example.com//https://github.com/owner/repo.git
+# 实际请求 https://example.com/https://github.com/owner/repo.git
 ```
 
-HubProxy 会自动规范化路径首部多余斜杠，上述写法与单斜杠前缀等价。
-
 取消配置：
 
 ```bash
-git config --global --unset url.https://example.com//https://github.com/.insteadOf
+git config --global --unset url.https://example.com/https://github.com/.insteadOf
 ```
 
 ### 省略 `https://`

docs/src/content/docs/security/overview.mdx

@@ -31,7 +31,7 @@ HubProxy **没有**管理后台登录、Basic Auth、API Key 或 Prometheus 指
 - 使用 [推荐部署架构](/deployment/architecture/)：CDN（可选）→ 反代 → HubProxy
 - 公网服务配置 `[access].whiteList`
 - 反代覆盖写 `X-Forwarded-For`、`X-Real-IP`、`X-Forwarded-Host`
-- 不要将 `5000` 端口暴露到公网
+- 公网服务建议通过反代暴露，不直接开放 `5000` 端口
 - 定期审查 `[access].blackList` 与访问日志
 
 ## 相关文档