feat(deploy): prepare.sh + config templates, migrate env to deploy/, gitignore rendered outputs

deploy/.env.example

@@ -0,0 +1,11 @@
+JWT_SECRET=change-me-openssl-rand-hex-32
+ADMIN_USER=admin
+ADMIN_PASSWORD=change-me-min-8
+SCAN_INTERVAL_SEC=60
+
+# ---- 部署参数(deploy/prepare.sh 渲染模板 / compose 插值用) ----
+WEB_PORT=8080
+NGINX_CLIENT_MAX_BODY_SIZE=200m
+REDIS_MAXMEMORY=128mb
+REDIS_MAXMEMORY_POLICY=allkeys-lru
+DELVE_PORT=2345

deploy/prepare.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# 渲染 deploy/templates/*.tpl → deploy/nginx、deploy/redis,并创建运行所需目录。
+# 约定:每次 up 之前(或改模板/.env 后)必须重跑本脚本。幂等,可反复执行。
+set -eu
+cd "$(dirname "$0")"
+
+if [ -f .env ]; then
+  set -a; . ./.env; set +a
+fi
+
+NGINX_CLIENT_MAX_BODY_SIZE=${NGINX_CLIENT_MAX_BODY_SIZE:-200m}
+REDIS_MAXMEMORY=${REDIS_MAXMEMORY:-128mb}
+REDIS_MAXMEMORY_POLICY=${REDIS_MAXMEMORY_POLICY:-allkeys-lru}
+
+for t in templates/nginx.conf.tpl templates/default.conf.tpl templates/redis.conf.tpl; do
+  [ -f "$t" ] || { echo "prepare.sh: missing template $t" >&2; exit 1; }
+done
+
+mkdir -p nginx/conf.d redis logs/nginx api/storage
+
+sed -e "s|{{NGINX_CLIENT_MAX_BODY_SIZE}}|${NGINX_CLIENT_MAX_BODY_SIZE}|g" \
+  templates/nginx.conf.tpl > nginx/nginx.conf
+sed -e "s|{{NGINX_CLIENT_MAX_BODY_SIZE}}|${NGINX_CLIENT_MAX_BODY_SIZE}|g" \
+  templates/default.conf.tpl > nginx/conf.d/default.conf
+sed -e "s|{{REDIS_MAXMEMORY}}|${REDIS_MAXMEMORY}|g" \
+  -e "s|{{REDIS_MAXMEMORY_POLICY}}|${REDIS_MAXMEMORY_POLICY}|g" \
+  templates/redis.conf.tpl > redis/redis.conf
+
+echo "prepare.sh: rendered nginx($(pwd)/nginx), redis($(pwd)/redis), logs($(pwd)/logs/nginx), storage($(pwd)/api/storage)"

deploy/templates/default.conf.tpl

@@ -0,0 +1,23 @@
+server {
+  listen 80;
+  client_max_body_size {{NGINX_CLIENT_MAX_BODY_SIZE}};
+  # 地址为占位默认值(127.0.0.11=Docker 内嵌 DNS);容器 entrypoint 启动时会按
+  # /etc/resolv.conf 的首个 nameserver 重写本行,兼容 podman aardvark-dns。
+  resolver 127.0.0.11 valid=10s;
+
+  # spec §7 风险接受所假设的 CSP:全部同源,blob:/data: 供 SW/reader 用
+  add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob: data:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' blob: data:; object-src 'none'; frame-src 'self' blob:" always;
+
+  location /api/ {
+    set $api_upstream http://api:8080;   # 变量式 → 每次按 DNS 解析,scale 后轮询到新副本(spec §11)
+    proxy_pass $api_upstream;            # 无 URI 部分:保留 /api 前缀转发
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
+
+  location / {
+    root /usr/share/nginx/html;
+    try_files $uri /index.html;
+  }
+}

deploy/templates/nginx.conf.tpl

@@ -0,0 +1,24 @@
+user  nginx;
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log notice;
+pid        /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    access_log  /var/log/nginx/access.log;
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    gzip  on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+
+    include /etc/nginx/conf.d/*.conf;
+}

deploy/templates/redis.conf.tpl

@@ -0,0 +1,4 @@
+# booklib redis 配置 — 由 deploy/prepare.sh 从 templates/redis.conf.tpl 渲染,勿直接编辑产物
+maxmemory {{REDIS_MAXMEMORY}}
+maxmemory-policy {{REDIS_MAXMEMORY_POLICY}}
+dir /data