www
58 lines
1.9 KiB
Markdown
58 lines
1.9 KiB
Markdown
# Deploy
|
|
|
|
This directory is reserved for local dependencies, Docker, Nginx, PM2/systemd, backup, and release scripts.
|
|
|
|
Stage 01 does not start infrastructure automatically.
|
|
|
|
Planned services:
|
|
|
|
- backend-api
|
|
- queue-worker
|
|
- ffmpeg-worker
|
|
- admin-web
|
|
- user-web
|
|
- mysql
|
|
- redis
|
|
- minio
|
|
- nginx
|
|
|
|
## HTTPS / API transport
|
|
|
|
Production API traffic must be served over HTTPS, even though JSON request and response bodies also use an application-layer encrypted envelope. The recommended layout is:
|
|
|
|
- Nginx terminates TLS on `443`.
|
|
- Frontend bundles call same-origin `/api` by default.
|
|
- Nginx proxies `/api/` to `http://127.0.0.1:3000/api/`.
|
|
- Nginx sets `X-Forwarded-Proto: https`.
|
|
- Backend runs with `HTTPS_REQUIRED=true` and `TRUST_PROXY=true`.
|
|
- Browser clients negotiate short-lived API crypto sessions through `GET /api/crypto/handshake`.
|
|
|
|
Example config:
|
|
|
|
```text
|
|
deploy/nginx.https.example.conf
|
|
```
|
|
|
|
Production environment example:
|
|
|
|
```bash
|
|
NODE_ENV=production
|
|
HTTPS_REQUIRED=true
|
|
HTTPS_ALLOW_LOCAL_HTTP=false
|
|
TRUST_PROXY=true
|
|
CORS_ORIGINS=https://manga.example.com,https://admin.manga.example.com
|
|
API_CRYPTO_ENABLED=auto
|
|
API_CRYPTO_SESSION_TTL_SECONDS=900
|
|
VITE_API_CRYPTO_ENABLED=auto
|
|
VITE_API_BASE_URL=/api
|
|
```
|
|
|
|
For local development, keep `HTTPS_REQUIRED=false` or leave `HTTPS_ALLOW_LOCAL_HTTP=true` so `http://127.0.0.1:3000/api` continues to work.
|
|
API crypto is off by default through `security.api_crypto_enabled=false`; enable it from the admin settings page after production deployment.
|
|
|
|
Notes:
|
|
|
|
- The encrypted envelope covers JSON request bodies, JSON responses, error responses, encrypted novel upload payloads, and encrypted private asset download payloads.
|
|
- HTTP method, path, host, and query string remain transport metadata. Do not place sensitive content in query parameters.
|
|
- The API crypto session store is in memory. Use sticky sessions or move the session store to Redis before horizontal backend scaling.
|