ai/deploy/README.md

Deploy

This directory is reserved for local dependencies, Docker, Nginx, PM2/systemd, backup, and release scripts.

Stage 01 does not start infrastructure automatically.

Planned services:

• backend-api
• queue-worker
• ffmpeg-worker
• admin-web
• user-web
• mysql
• redis
• minio
• nginx

HTTPS / API transport

Production API traffic must be served over HTTPS, even though JSON request and response bodies also use an application-layer encrypted envelope. The recommended layout is:

• Nginx terminates TLS on 443.
• Frontend bundles call same-origin /api by default.
• Nginx proxies /api/ to http://127.0.0.1:3000/api/.
• Nginx sets X-Forwarded-Proto: https.
• Backend runs with HTTPS_REQUIRED=true and TRUST_PROXY=true.
• Browser clients negotiate short-lived API crypto sessions through GET /api/crypto/handshake.

Example config:

deploy/nginx.https.example.conf

Production environment example:

NODE_ENV=production
HTTPS_REQUIRED=true
HTTPS_ALLOW_LOCAL_HTTP=false
TRUST_PROXY=true
CORS_ORIGINS=https://manga.example.com,https://admin.manga.example.com
API_CRYPTO_ENABLED=auto
API_CRYPTO_SESSION_TTL_SECONDS=900
VITE_API_CRYPTO_ENABLED=auto
VITE_API_BASE_URL=/api

For local development, keep HTTPS_REQUIRED=false or leave HTTPS_ALLOW_LOCAL_HTTP=true so http://127.0.0.1:3000/api continues to work. API crypto is off by default through security.api_crypto_enabled=false; enable it from the admin settings page after production deployment.

Notes:

• The encrypted envelope covers JSON request bodies, JSON responses, error responses, encrypted novel upload payloads, and encrypted private asset download payloads.
• HTTP method, path, host, and query string remain transport metadata. Do not place sensitive content in query parameters.
• The API crypto session store is in memory. Use sticky sessions or move the session store to Redis before horizontal backend scaling.