Initial AI manga platform

2026-06-15 17:45:28 +08:00
commit 7a8191650f
267 changed files with 105987 additions and 0 deletions
@@ -0,0 +1,57 @@
+# Deploy
+
+This directory is reserved for local dependencies, Docker, Nginx, PM2/systemd, backup, and release scripts.
+
+Stage 01 does not start infrastructure automatically.
+
+Planned services:
+
+- backend-api
+- queue-worker
+- ffmpeg-worker
+- admin-web
+- user-web
+- mysql
+- redis
+- minio
+- nginx
+
+## HTTPS / API transport
+
+Production API traffic must be served over HTTPS, even though JSON request and response bodies also use an application-layer encrypted envelope. The recommended layout is:
+
+- Nginx terminates TLS on `443`.
+- Frontend bundles call same-origin `/api` by default.
+- Nginx proxies `/api/` to `http://127.0.0.1:3000/api/`.
+- Nginx sets `X-Forwarded-Proto: https`.
+- Backend runs with `HTTPS_REQUIRED=true` and `TRUST_PROXY=true`.
+- Browser clients negotiate short-lived API crypto sessions through `GET /api/crypto/handshake`.
+
+Example config:
+
+```text
+deploy/nginx.https.example.conf
+```
+
+Production environment example:
+
+```bash
+NODE_ENV=production
+HTTPS_REQUIRED=true
+HTTPS_ALLOW_LOCAL_HTTP=false
+TRUST_PROXY=true
+CORS_ORIGINS=https://manga.example.com,https://admin.manga.example.com
+API_CRYPTO_ENABLED=auto
+API_CRYPTO_SESSION_TTL_SECONDS=900
+VITE_API_CRYPTO_ENABLED=auto
+VITE_API_BASE_URL=/api
+```
+
+For local development, keep `HTTPS_REQUIRED=false` or leave `HTTPS_ALLOW_LOCAL_HTTP=true` so `http://127.0.0.1:3000/api` continues to work.
+API crypto is off by default through `security.api_crypto_enabled=false`; enable it from the admin settings page after production deployment.
+
+Notes:
+
+- The encrypted envelope covers JSON request bodies, JSON responses, error responses, encrypted novel upload payloads, and encrypted private asset download payloads.
+- HTTP method, path, host, and query string remain transport metadata. Do not place sensitive content in query parameters.
+- The API crypto session store is in memory. Use sticky sessions or move the session store to Redis before horizontal backend scaling.