diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 7565900..b043fc7 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -10,6 +10,22 @@ concurrency:
   group: meezi-cicd-${{ github.ref }}
   cancel-in-progress: true
 
+# ─────────────────────────────────────────────────────────────────────────────
+# HOW THIS WORKS
+# ─────────────────────────────────────────────────────────────────────────────
+# Runner labels (in gitea docker-compose):
+#   ubuntu-latest:docker://node:20-alpine   ← CI jobs run in real Docker containers
+#   self-hosted:host                        ← deploy runs directly on the server
+#
+# All images are pulled from local Nexus mirrors (fast, no internet):
+#   Docker Hub → http://171.22.25.73:5000   (docker-hub-proxy repo)
+#   MCR        → http://171.22.25.73:5002   (mcr-proxy repo)
+#
+# mirror hostname → host-gateway (docker bridge IP 172.17.0.1) — used for:
+#   NuGet  → http://mirror:8081/repository/nuget-group/
+#   npm    → http://mirror:8081/repository/npm-group/
+# ─────────────────────────────────────────────────────────────────────────────
+
 jobs:
 
   api-build:
@@ -52,9 +68,17 @@ jobs:
           git checkout FETCH_HEAD
 
       - name: Write NuGet config
-        run: >-
-          python3 -c
-          "open('/tmp/nuget.ci.config','w').write('<?xml version=\"1.0\" encoding=\"utf-8\"?><configuration><packageSources><clear /><add key=\"nexus\" value=\"http://mirror:8081/repository/nuget-group/index.json\" protocolVersion=\"3\" allowInsecureConnections=\"true\" /></packageSources></configuration>')"
+        run: |
+          cat > /tmp/nuget.ci.config << 'EOF'
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+              <clear />
+              <add key="nexus" value="http://mirror:8081/repository/nuget-group/index.json"
+                   protocolVersion="3" allowInsecureConnections="true" />
+            </packageSources>
+          </configuration>
+          EOF
 
       - name: Restore
         run: dotnet restore src/Meezi.API/Meezi.API.csproj --configfile /tmp/nuget.ci.config
@@ -91,9 +115,17 @@ jobs:
           git checkout FETCH_HEAD
 
       - name: Write NuGet config
-        run: >-
-          python3 -c
-          "open('/tmp/nuget.ci.config','w').write('<?xml version=\"1.0\" encoding=\"utf-8\"?><configuration><packageSources><clear /><add key=\"nexus\" value=\"http://mirror:8081/repository/nuget-group/index.json\" protocolVersion=\"3\" allowInsecureConnections=\"true\" /></packageSources></configuration>')"
+        run: |
+          cat > /tmp/nuget.ci.config << 'EOF'
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+              <clear />
+              <add key="nexus" value="http://mirror:8081/repository/nuget-group/index.json"
+                   protocolVersion="3" allowInsecureConnections="true" />
+            </packageSources>
+          </configuration>
+          EOF
 
       - name: Restore
         run: dotnet restore src/Meezi.Admin.API/Meezi.Admin.API.csproj --configfile /tmp/nuget.ci.config
@@ -227,6 +259,10 @@ jobs:
         env:
           NEXT_PUBLIC_API_URL: http://localhost:5080
 
+# ─────────────────────────────────────────────────────────────────────────────
+# DEPLOY — only on push to main, only if ALL CI jobs pass.
+# self-hosted:host — runs directly on your server where Docker is installed.
+# ─────────────────────────────────────────────────────────────────────────────
   deploy:
     name: "Deploy · all services"
     runs-on: self-hosted
diff --git a/docker-compose.mirror.yml b/docker-compose.mirror.yml
index 8e9204e..c185e4c 100644
--- a/docker-compose.mirror.yml
+++ b/docker-compose.mirror.yml
@@ -30,7 +30,8 @@ services:
       - nexus-data:/nexus-data
     ports:
       - "8081:8081"   # Web UI + NuGet + npm REST API
-      - "5000:5000"   # Docker Hub pull-through proxy (httpPort configured in docker-hub-proxy repo)
+      - "5000:5000"   # Docker Hub proxy  (docker-hub-proxy repo  httpPort: 5000)
+      - "5002:5002"   # MCR proxy         (mcr-proxy repo          httpPort: 5002)
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://localhost:8081/service/rest/v1/status"]
       interval: 30s