feat: establish production SaaS foundation

deploy.env.example

@@ -0,0 +1,93 @@
+# Copy this file to /opt/tiku-saas/shared/deploy.env on the server.
+# Do not commit the real deploy.env.
+
+APP_NAME=tiku-supabase
+REPO_URL=https://git.gongxue100.com/chenhaogxjy/tiku-supabase.git
+BRANCH=main
+DEPLOY_ROOT=/opt/tiku-saas
+KEEP_RELEASES=5
+
+# Private Gitea repository access.
+# Prefer a short-lived token with read-only repository scope.
+# Do not put the token in REPO_URL.
+# GIT_USERNAME=chenhaogxjy
+# GITEA_TOKEN=replace-with-rotated-readonly-token
+
+# Install/build/check gates.
+NPM_INSTALL_COMMAND="npm ci --workspaces --include-workspace-root --include=dev"
+# Audit metadata must come from an npm registry that implements the audit API.
+# Keep this on the official registry even if package downloads use a mirror.
+NPM_AUDIT_REGISTRY=https://registry.npmjs.org/
+RUN_CHECKS=true
+CHECK_COMMANDS="npm run check:api
+npm run check:worker
+npm run check:taro"
+RUN_API_BUILD=true
+RUN_WORKER_BUILD=true
+RUN_TARO_H5_BUILD=true
+RUN_SECURITY_REPO_SCAN=true
+RUN_RUNTIME_AUDIT=true
+# This audit covers dependencies that ship in the Taro H5/miniapp bundle.
+RUN_TARO_SUPPLY_CHAIN_AUDIT=true
+
+# Production gates.
+# auto runs readiness:production when NODE_ENV=production.
+NODE_ENV=production
+RUN_PRODUCTION_READINESS=auto
+RUN_DB_READINESS=true
+
+# Database migrations are intentionally opt-in. Enable only after backup and rehearsal.
+# When enabled, the deploy script runs readiness:production:db again after db push
+# and before launch:gate; production refuses to disable that post-migration check.
+RUN_DB_MIGRATIONS=false
+# Do not assign this in the file; inject DATABASE_MIGRATION_URL for the standard
+# migration role from a secret manager immediately before deployment.
+DB_MIGRATION_COMMAND='supabase db push --db-url "$DATABASE_MIGRATION_URL"'
+
+# H5 runtime configs stay in shared/ and are symlinked into each release dist.
+# Production deployment blocks until these files exist and pass strict validation.
+STRICT_H5_RUNTIME_CONFIG=true
+RUN_H5_SMOKE=true
+H5_STUDENT_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-student.runtime-config.json
+H5_TENANT_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-tenant-admin.runtime-config.json
+H5_PLATFORM_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-platform-admin.runtime-config.json
+
+# Nginx serves /srv/tiku-saas/www/{student,tenant-admin,platform-admin}.
+# The deployer stages versioned Web roots beside this path and atomically switches
+# /srv/tiku-saas/www after all candidate checks pass.
+WWW_ROOT=/srv/tiku-saas/www
+WWW_RELEASES_DIR=/srv/tiku-saas/www-releases
+
+# The bundled systemd units run from /opt/tiku-saas/repo. The deployer explicitly
+# synchronizes the selected current release into this runtime directory before restart.
+SERVICE_REPO_DIR=/opt/tiku-saas/repo
+SYNC_SERVICE_REPO=true
+
+# Real production evidence is generated out-of-band and stays in shared/, never in Git.
+RUN_LAUNCH_GATE=true
+PRODUCTION_LAUNCH_EVIDENCE=/opt/tiku-saas/shared/production-launch-evidence.json
+
+# Production defaults are fail-closed: a real restart strategy and healthcheck are required.
+SERVICE_MODE=systemd
+SYSTEMD_UNITS="tiku-api.service tiku-workers.target"
+
+# systemd example:
+# SERVICE_MODE=systemd
+# SYSTEMD_UNITS="tiku-api.service tiku-workers.target"
+
+# pm2 example:
+# SERVICE_MODE=pm2
+# PM2_ECOSYSTEM=/opt/tiku-saas/current/ecosystem.config.cjs
+# PM2_PROCESS_NAMES="tiku-api tiku-worker"
+
+# docker compose example:
+# SERVICE_MODE=compose
+# COMPOSE_FILE=/opt/tiku-saas/current/docker-compose.api.yml
+
+# Fully custom restart hook. Runs after current symlink switches.
+# RESTART_COMMAND='systemctl restart tiku-api.service tiku-workers.target'
+
+# Production refuses to report success without this healthcheck.
+HEALTHCHECK_URL=http://127.0.0.1:8787/health
+HEALTHCHECK_TIMEOUT_SECONDS=60
+HEALTHCHECK_INTERVAL_SECONDS=2