# Deploy

This directory is reserved for local dependencies, Docker, Nginx, PM2/systemd, backup, and release scripts.

Stage 01 does not start infrastructure automatically.

Planned services:

- backend-api
- queue-worker
- ffmpeg-worker
- admin-web
- user-web
- mysql
- redis
- minio
- nginx

## HTTPS / API transport

Production API traffic must be served over HTTPS, even though JSON request and response bodies also use an application-layer encrypted envelope. The recommended layout is:

- Nginx terminates TLS on `443`.
- Frontend bundles call same-origin `/api` by default.
- Nginx proxies `/api/` to `http://127.0.0.1:3000/api/`.
- Nginx sets `X-Forwarded-Proto: https`.
- Backend runs with `HTTPS_REQUIRED=true` and `TRUST_PROXY=true`.
- Browser clients negotiate short-lived API crypto sessions through `GET /api/crypto/handshake`.

Example config:

```text
deploy/nginx.https.example.conf
```

Production environment example:

```bash
NODE_ENV=production
HTTPS_REQUIRED=true
HTTPS_ALLOW_LOCAL_HTTP=false
TRUST_PROXY=true
CORS_ORIGINS=https://manga.example.com,https://admin.manga.example.com
API_CRYPTO_ENABLED=auto
API_CRYPTO_SESSION_TTL_SECONDS=900
VITE_API_CRYPTO_ENABLED=auto
VITE_API_BASE_URL=/api
```

For local development, keep `HTTPS_REQUIRED=false` or leave `HTTPS_ALLOW_LOCAL_HTTP=true` so `http://127.0.0.1:3000/api` continues to work.
API crypto is off by default through `security.api_crypto_enabled=false`; enable it from the admin settings page after production deployment.

Notes:

- The encrypted envelope covers JSON request bodies, JSON responses, error responses, encrypted novel upload payloads, and encrypted private asset download payloads.
- HTTP method, path, host, and query string remain transport metadata. Do not place sensitive content in query parameters.
- The API crypto session store is in memory. Use sticky sessions or move the session store to Redis before horizontal backend scaling.