.github/workflows/release-windows.yml

@@ -25,8 +25,7 @@ jobs:
       - name: Build release stage
         shell: pwsh
         run: |
-          # Use pwsh -File (UTF-8). Nested Windows PowerShell 5.1 mis-parses UTF-8 scripts without BOM.
-          & ./packaging/build_release.ps1 -CreateVenv
+          powershell -ExecutionPolicy Bypass -File ./packaging/build_release.ps1 -CreateVenv
 
       - name: Install Inno Setup
         shell: pwsh

packaging/README.md

@@ -122,7 +122,7 @@ Do this on the **dev PC on the home LAN** after bumping version:
 
 1. **Build** — `.\packaging\build_release.ps1 -CreateVenv` + Inno Setup → `NetX-Setup-*.exe`
 2. **GitHub** — `.\packaging\publish_release.ps1 -Version x.y.z` (uploads Setup.exe only)
-3. **Forgejo** — upload the same Setup.exe (default: public domain `https://git.avelo.top`):
+3. **Forgejo (intranet)** — upload the same Setup.exe to QNAP Forgejo; public `git.avelo.top` is only a reverse proxy to the same instance:
 
 ```powershell
 # One-time: User env var (never commit the token)
@@ -130,22 +130,23 @@ Do this on the **dev PC on the home LAN** after bumping version:
 [Environment]::SetEnvironmentVariable("NETX_FORGEJO_TOKEN", "your_token", "User")
 # Restart Cursor / open a new terminal so the agent/scripts see it
 
-# Default: https://git.avelo.top
-.\packaging\publish_forgejo_release.ps1 -Version 0.4.11
+# Default publishes to LAN Forgejo; public git.avelo.top shows the same Release.
+.\packaging\publish_forgejo_release.ps1 -Version 0.4.0
 
-# Optional when LAN IP is reachable:
-# .\packaging\publish_forgejo_release.ps1 -Version 0.4.11 -ForgejoBase "http://10.0.0.131:3000"
+# Only when off the home LAN:
+# .\packaging\publish_forgejo_release.ps1 -Version 0.4.0 -ForgejoBase "https://git.avelo.top"
 ```
 
 | Role | URL |
 |------|-----|
-| Publish default | `https://git.avelo.top` (`-ForgejoBase` default) |
-| Optional LAN | `http://10.0.0.131:3000` |
+| Publish default (home LAN) | `http://10.0.0.131:3000` (`-ForgejoBase` default) |
+| Clients / remote clone | `https://git.avelo.top` (Caddy → `10.0.0.131:3000`) |
 | Update probe (default) | GitHub + `https://git.avelo.top/.../releases/latest` |
 
 Verify:
 
-- https://git.avelo.top/hansjone/netx/releases
+- LAN: http://10.0.0.131:3000/hansjone/netx/releases
+- Public: https://git.avelo.top/hansjone/netx/releases
 - Probe: `.\packaging\check_update.ps1` → both `github` and `forgejo` reachable with the new version
 
 Token: `NETX_FORGEJO_TOKEN` (or `FORGEJO_TOKEN`).

packaging/build_release.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$Version = "",
     [string]$OutDir = "",
     [switch]$SkipWebBuild = $false,
@@ -128,13 +128,13 @@ if (Test-Path $winswShip) {
     Copy-Item -Path $winswShip -Destination (Join-Path $winswOut "WinSW-x64.exe") -Force
     Write-Host "==> Bundled WinSW for offline service install"
 } else {
-    Write-Host "[WARN] WinSW missing - offline service install will fail" -ForegroundColor Yellow
+    Write-Host "[WARN] WinSW missing — offline service install will fail" -ForegroundColor Yellow
 }
 New-Item -ItemType Directory -Path (Join-Path $packOut "postgres") -Force | Out-Null
 Copy-Item -Path (Join-Path $PSScriptRoot "postgres\README.md") -Destination (Join-Path $packOut "postgres\README.md") -Force
 
 if (Test-Path (Join-Path $pgsql "bin\pg_ctl.exe")) {
-    Write-Host '==> Copying bundled PostgreSQL (bin/lib/share; skip doc/)'
+    Write-Host "==> Copying bundled PostgreSQL (bin/lib/share; skip doc/)"
     $pgStage = Join-Path $stage "postgres\pgsql"
     New-Item -ItemType Directory -Path $pgStage -Force | Out-Null
     foreach ($sub in @("bin", "lib", "share")) {
@@ -196,7 +196,7 @@ if ($CreateVenv) {
 
     $venvDir = Join-Path $stage ".venv"
     if (Test-Path $venvDir) { Remove-Item -Recurse -Force $venvDir }
-    Write-Host '==> Creating .venv from shipped runtime (--copies)'
+    Write-Host "==> Creating .venv from shipped runtime (--copies)"
     & $rtPy -m venv $venvDir --copies
     if ($LASTEXITCODE -ne 0) { throw "venv_create_failed" }
 

packaging/check_update.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$ProgramRoot = "",
     [string]$DataRoot = "",
     [string]$UpdateUrl = "",

packaging/publish_forgejo_release.ps1

@@ -1,6 +1,6 @@
-param(
+param(
     [string]$Version = "",
-    [string]$ForgejoBase = "https://git.avelo.top",
+    [string]$ForgejoBase = "http://10.0.0.131:3000",
     [string]$Owner = "hansjone",
     [string]$Repo = "netx",
     [string]$Token = "",
@@ -9,14 +9,14 @@
 
 # Publish Windows Setup.exe to Forgejo/Gitea (mirror sync does NOT copy GitHub Release files).
 # Requires a Forgejo token with repo write (Settings → Applications → Generate New Token).
-# Default: https://git.avelo.top (public domain). LAN IP only when explicitly reachable.
+# Default: home LAN Forgejo. Public git.avelo.top is the same instance (VPS reverse proxy).
 #
-# Example:
+# Example (usual — LAN):
 #   $env:NETX_FORGEJO_TOKEN = "..."   # or User env NETX_FORGEJO_TOKEN
-#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.11
+#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.0
 #
-# Optional LAN (when 10.0.0.131 is reachable):
-#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.11 -ForgejoBase "http://10.0.0.131:3000"
+# Away from LAN only (hairpins via VPS):
+#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.0 -ForgejoBase "https://git.avelo.top"
 
 $ErrorActionPreference = "Stop"
 . "$PSScriptRoot\_common.ps1"
@@ -112,8 +112,7 @@ function Upload-ForgejoAsset {
     $url = "$apiBase/releases/$relId/assets"
     $curl = Get-Command curl.exe -ErrorAction SilentlyContinue
     if (-not $curl) { throw "curl.exe required for asset upload" }
-    # --ssl-no-revoke: schannel CRYPT_E_REVOCATION_OFFLINE often fails via proxy/offline CA.
-    & $curl.Source -f -sS --ssl-no-revoke -X POST `
+    & $curl.Source -f -sS -X POST `
         -H "Authorization: token $Token" `
         -F "attachment=@$Path" `
         $url

packaging/publish_release.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$Version = "",
     [switch]$SkipBuild = $false,
     [switch]$SkipInstaller = $false,

packaging/update_netx.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [Parameter(Mandatory = $true)]
     [string]$PackagePath,
     [string]$ProgramRoot = "",