Update DEPLOY.md: production domain + clean sensitive values

- Domain: api.synaglobal.vip (强制 HTTPS)
- Website directory: /www/wwwroot/api.synaglobal.vip
- Supervisor config using .env (no hardcoded passwords)
- MySQL create DB command uses placeholder password
- Nginx config with 宝塔 SSL path and PHP-FPM socket
- All sensitive values removed from doc — safe for Git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Nexus/docs/DEPLOY.md

@@ -3,6 +3,8 @@
 > **项目**: Nexus — 服务器运维管理平台  
 > **版本**: 6.0.0  
 > **技术栈**: Python 3.12+ / FastAPI / Async SQLAlchemy / MySQL 8.4 / Redis 7 / PHP 8.2+ / Nginx  
+> **生产域名**: `api.synaglobal.vip` (强制 HTTPS)  
+> **网站目录**: `/www/wwwroot/api.synaglobal.vip`  
 > **更新日期**: 2026-05-20  
 
 ---
@@ -290,34 +292,33 @@ cp .env.example .env
 nano .env
 ```
 
-`.env` 必填项：
+`.env` 必填项（**⚠️ .env 文件不会被提交到 Git，已在 .gitignore 中排除**）：
 
 ```ini
 # ⚠️ SECRET_KEY 必须设置，否则 Nexus 无法启动
 NEXUS_SECRET_KEY=<生成一个随机密钥: python3 -c "import secrets; print(secrets.token_urlsafe(32))">
 
 # 数据库连接（aiomysql 驱动）
-NEXUS_DATABASE_URL=mysql+aiomysql://nexus:your_password@127.0.0.1:3306/nexus
+NEXUS_DATABASE_URL=mysql+aiomysql://Nexus:<你的密码>@127.0.0.1:3306/Nexus
 
 # Redis
 NEXUS_REDIS_URL=redis://127.0.0.1:6379/0
 
 # API Key（Agent 认证用）
 NEXUS_API_KEY=<生成: python3 -c "import secrets; print(secrets.token_urlsafe(24))">
-
-# 加密密钥（可选，默认从 SECRET_KEY 派生）
-NEXUS_ENCRYPTION_KEY=
 ```
 
+> **⚠️ 安全提示**: `.env` 文件包含密码和密钥，绝不能提交到 Git。项目 `.gitignore` 已排除 `.env`。
+
 ### 3.4 创建 MySQL 数据库
 
 ```bash
 sudo mysql -u root -p
 
 # 在 MySQL 中执行:
-CREATE DATABASE nexus CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-CREATE USER 'nexus'@'localhost' IDENTIFIED BY 'your_password';
-GRANT ALL PRIVILEGES ON nexus.* TO 'nexus'@'localhost';
+CREATE DATABASE Nexus CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE USER 'Nexus'@'localhost' IDENTIFIED BY '<你的数据库密码>';
+GRANT ALL PRIVILEGES ON Nexus.* TO 'Nexus'@'localhost';
 FLUSH PRIVILEGES;
 EXIT;
 ```
@@ -342,14 +343,15 @@ sudo nano /etc/supervisor/conf.d/nexus.conf
 
 ```ini
 [program:nexus]
-command=/opt/Nexus/venv/bin/uvicorn server.main:app --host 0.0.0.0 --port 8600 --workers 4
-directory=/opt/Nexus
+command=/www/wwwroot/api.synaglobal.vip/venv/bin/uvicorn server.main:app --host 0.0.0.0 --port 8600 --workers 4
+directory=/www/wwwroot/api.synaglobal.vip
 user=root
 autostart=true
 autorestart=true
 stderr_logfile=/var/log/nexus/error.log
 stdout_logfile=/var/log/nexus/access.log
-environment=NEXUS_SECRET_KEY="your_secret_key",NEXUS_DATABASE_URL="mysql+aiomysql://nexus:password@127.0.0.1:3306/nexus"
+# ⚠️ 不要在这里硬编码密码！Supervisor 配置文件可能被其他用户读取
+# 改用 .env 文件方式：uvicorn 会自动读取 .env
 ```
 
 ```bash
@@ -367,7 +369,7 @@ sudo nano /etc/nginx/sites-available/nexus
 ```nginx
 server {
     listen 80;
-    server_name your-domain.com;
+    server_name api.synaglobal.vip;
 
     # 强制 HTTPS
     return 301 https://$server_name$request_uri;
@@ -375,11 +377,14 @@ server {
 
 server {
     listen 443 ssl http2;
-    server_name your-domain.com;
+    server_name api.synaglobal.vip;
 
-    # SSL证书（宝塔面板一键配置 Let's Encrypt）
-    ssl_certificate     /etc/letsencrypt/live/your-domain.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
+    # SSL证书（宝塔面板 → 网站 → SSL → Let's Encrypt 一键申请）
+    # 证书路径在宝塔面板申请后自动生成，以下为宝塔默认路径:
+    ssl_certificate     /www/server/panel/vhost/cert/api.synaglobal.vip/fullchain.pem;
+    ssl_certificate_key /www/server/panel/vhost/cert/api.synaglobal.vip/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
 
     # Nexus API
     location /api/ {
@@ -388,6 +393,15 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    # Nexus OpenAPI 文档
+    location /docs {
+        proxy_pass http://127.0.0.1:8600;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
     }
 
     # Nexus WebSocket
@@ -396,16 +410,17 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
+        proxy_set_header X-Real-IP $remote_addr;
     }
 
     # PHP 页面（前端）
     location / {
-        root /opt/Nexus/web;
+        root /www/wwwroot/api.synaglobal.vip;
         index index.php;
         try_files $uri $uri/ /index.php?$query_string;
 
         location ~ \.php$ {
-            fastcgi_pass unix:/run/php/php8.2-fpm.sock;
+            fastcgi_pass unix:/tmp/php-cgi-82.sock;
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             include fastcgi_params;
         }
@@ -485,9 +500,6 @@ curl http://127.0.0.1:8600/docs  # 应返回 OpenAPI 文档页面
 # 检查数据库连接
 curl http://127.0.0.1:8600/api/settings/  # 应返回设置列表（初始为空）
 
-# 检查 Agent 心跳端点
-curl -X POST http://127.0.0.1:8600/api/agent/heartbeat \
-  -H "X-API-Key: your_api_key" \
-  -H "Content-Type: application/json" \
-  -d '{"server_id": 1, "is_online": true}'
+# 检查 HTTPS（域名验证）
+curl https://api.synaglobal.vip/docs  # 应返回 OpenAPI 文档页面
 ``