feat: PM2 + Docker deployment config (MySQL container, PM2 for backend+frontend proxy)

apps/admin/nginx.conf

@@ -1,11 +1,28 @@
 server {
     listen 80;
-    server_name localhost;
+    server_name _;
     root /usr/share/nginx/html;
     index index.html;
 
+    # gzip
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript;
+    gzip_min_length 256;
+
+    # security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
+    # static assets with long cache
+    location /assets/ {
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
     }
 
     location /api/ {
@@ -13,5 +30,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
     }
 }

apps/server/src/app.module.ts

@@ -108,7 +108,7 @@ import { CampusScopeMiddleware } from './common/campus-scope.middleware';
             password: config.get('DB_PASSWORD', ''),
             database: config.get('DB_DATABASE', 'dorm_billing'),
             entities: allEntities,
-            synchronize: true,
+            synchronize: config.get('DB_SYNCHRONIZE', 'true') !== 'false',
             charset: 'utf8mb4',
           };
         }
@@ -116,7 +116,7 @@ import { CampusScopeMiddleware } from './common/campus-scope.middleware';
           type: 'better-sqlite3' as const,
           database: config.get('DB_DATABASE', 'dorm_billing.db'),
           entities: allEntities,
-          synchronize: true,
+          synchronize: config.get('DB_SYNCHRONIZE', 'true') !== 'false',
         };
       },
     }),