docs: rewrite consume path section 4 for self-hosted VPS fileApi + rsync publish

Migrate client downloads off the external dandanton.com Nexus/CDN onto
http://159.75.5.225:19527/tdlm-client (nginx static, SHA-1 verified).

.github/workflows/publish-tdlm.yml

@@ -138,6 +138,17 @@ jobs:
 
           def put(name: str, data: bytes):
               url = upload_root + "/" + urllib.parse.quote(name, safe="")
+              # Gitea refuses to overwrite a generic package file (HTTP 409), so the previous copy of this one
+              # file is deleted right before it is uploaded again (keeps the gap without a file as short as possible).
+              delete = urllib.request.Request(url, method="DELETE")
+              delete.add_header("Authorization", "token " + token)
+              delete.add_header("User-Agent", "tdlm-hmcl-publish")
+              try:
+                  with urllib.request.urlopen(delete, timeout=300) as response:
+                      response.read()
+              except urllib.error.HTTPError as exc:
+                  if exc.code != 404:
+                      raise SystemExit("HTTP %s deleting the old %s: %s" % (exc.code, name, exc.read()[:300]))
               request = urllib.request.Request(url, data=data, method="PUT")
               request.add_header("Authorization", "token " + token)
               request.add_header("Content-Type", "application/octet-stream")
@@ -204,7 +215,7 @@ jobs:
               "- %s/HMCL.jar\n\n"
               "TDLMPack does not Maven-resolve this launcher; point the pack README / install docs at these URLs "
               "instead of hand-copying exe/jar.\n"
-              "Client pack fileApi default: https://packages.dandanton.com/tdlm-client/latest\n"
+              "Client pack fileApi default: http://159.75.5.225:19527/tdlm-client\n"
               "(Pack must publish/mirror the same layout; see docs/TDLM_CONSUME.md).\n"
           ) % (package_root, package_root)
 

HMCL/src/main/java/org/jackhuang/hmcl/Metadata.java

@@ -141,9 +141,9 @@ public final class Metadata {
         return null;
     }
 
-    /// Default client Server Modpack fileApi: the Nexus raw repository `tdlm-client` read through the CDN host.
+    /// Default client Server Modpack fileApi: self-hosted static mirror on the TDLM VPS (nginx, port 19527).
     public static final String DEFAULT_CLIENT_FILE_API =
-            "https://maven.dandanton.com/repository/tdlm-client";
+            "http://159.75.5.225:19527/tdlm-client";
 
     /// Stable client update root (`server-manifest.json` and `overrides/` live under this URL).
     ///

docs/TDLM_CONSUME.md

@@ -46,26 +46,33 @@ Assets on each tag: `HMCL.exe`, `HMCL.jar`, plus `.sha256` files.
 In `TDLM/TDLMPack` README §启动, replace the repo-only “安装 TDLM/HMCL” step with one of the URLs above.
 **Do not** add HMCL as a Gradle/Maven dependency of the pack — pack CI stays pack-only.
 
-### 4. Client pack fileApi (CDN)
+### 4. Client pack fileApi (self-hosted VPS)
 
 HMCL default (`Metadata.DEFAULT_CLIENT_FILE_API`):
 
 ```text
-https://packages.dandanton.com/tdlm-client/latest
+http://159.75.5.225:19527/tdlm-client
 ```
 
 First install / updates fetch `{fileApi}/server-manifest.json` (and `overrides/**` under that root).
 Override at runtime: `-Dhmcl.client.fileApi=…` or jar attribute `hmcl.client.fileApi`.
 
+The fileApi is a read-only nginx static mirror on the TDLM VPS (`159.75.5.225`, port `19527`,
+root `/var/www/tdlm-dl`). Players read it anonymously; integrity is verified by the SHA-1 hashes
+in `server-manifest.json`.
+
 **TDLMPack must use the same URL** so `server-manifest.json` embeds it:
 
 ```text
-TDLM_CLIENT_FILE_API=https://packages.dandanton.com/tdlm-client/latest
+TDLM_CLIENT_FILE_API=http://159.75.5.225:19527/tdlm-client
 ```
 
-Set that as the Gitea Actions **variable** on `TDLM/TDLMPack` (pack.yml already passes `vars.TDLM_CLIENT_FILE_API`).
+Set that as the Gitea Actions **variable** on `TDLM/TDLMPack` (pack.yml passes `vars.TDLM_CLIENT_FILE_API`;
+`PackBuild.DEFAULT_FILE_API` is the build-time fallback).
 
-**Publish caveat:** Pack’s current workflow PUTs the client tree to whatever `TDLM_CLIENT_FILE_API` is (upload root = fileApi). Today that defaults to Gitea generic
-`https://git.nest.potatolab.uk:8443/api/packages/TDLM/generic/tdlm-client/latest`.
-If you only change the HMCL default to the CDN and leave Pack publishing to Gitea, players will 404 unless you **mirror/sync** Gitea → `packages.dandanton.com/tdlm-client/latest`.
-If you set `TDLM_CLIENT_FILE_API` to the CDN URL, Pack CI must be able to PUT to that CDN (or you must split “upload origin” from “public fileApi” in Pack — not implemented today). Do not point HMCL at the CDN without one of those two ops paths.
+**Publish path (upload origin split from public fileApi):** Pack CI no longer PUTs to the read URL.
+The `pack.yml` "Publish the client Server Modpack to fileApi" step rsyncs `build/pack/client/overrides/`
+then `server-manifest.json` (manifest last) over SSH to `ubuntu@159.75.5.225:/var/www/tdlm-dl/tdlm-client`.
+Auth is the repo secret `TDLM_VPS_SSH_KEY`, an ed25519 deploy key confined on the VPS by
+`command="/usr/bin/rrsync /var/www/tdlm-dl/tdlm-client"` (rsync-only, no shell, no forwarding).
+The public port 19527 serves GET/HEAD only — there is no public write surface.