Deploy

This directory is reserved for local dependencies, Docker, Nginx, PM2/systemd, backup, and release scripts.

Stage 01 does not start infrastructure automatically.

Planned services:

backend-api
queue-worker
ffmpeg-worker
admin-web
user-web
mysql
redis
minio
nginx

HTTPS / API transport

Production API traffic must be served over HTTPS, even though JSON request and response bodies also use an application-layer encrypted envelope. The recommended layout is:

Nginx terminates TLS on 443.
Frontend bundles call same-origin /api by default.
Nginx proxies /api/ to http://127.0.0.1:3000/api/.
Nginx sets X-Forwarded-Proto: https.
Backend runs with HTTPS_REQUIRED=true and TRUST_PROXY=true.
Browser clients negotiate short-lived API crypto sessions through GET /api/crypto/handshake.

Example config:

deploy/nginx.https.example.conf

Production environment example:

NODE_ENV=production
HTTPS_REQUIRED=true
HTTPS_ALLOW_LOCAL_HTTP=false
TRUST_PROXY=true
CORS_ORIGINS=https://manga.example.com,https://admin.manga.example.com
API_CRYPTO_ENABLED=auto
API_CRYPTO_SESSION_TTL_SECONDS=900
VITE_API_CRYPTO_ENABLED=auto
VITE_API_BASE_URL=/api

For local development, keep HTTPS_REQUIRED=false or leave HTTPS_ALLOW_LOCAL_HTTP=true so http://127.0.0.1:3000/api continues to work. API crypto is off by default through security.api_crypto_enabled=false; enable it from the admin settings page after production deployment.

Notes:

The encrypted envelope covers JSON request bodies, JSON responses, error responses, encrypted novel upload payloads, and encrypted private asset download payloads.
HTTP method, path, host, and query string remain transport metadata. Do not place sensitive content in query parameters.
The API crypto session store is in memory. Use sticky sessions or move the session store to Redis before horizontal backend scaling.

1.9 KiB Raw Blame History

Deploy

HTTPS / API transport

1.9 KiB

Raw Blame History