部署指南

Runtime 服务

生产 Runtime 必须只监听 loopback：

./zava.elf --name Production --data-dir /var/lib/zava/production \
  --http-host 127.0.0.1 --http-port 8080

前置 Nginx：

server {
    listen 443 ssl http2;
    server_name api.zava.run;

    ssl_certificate /etc/letsencrypt/live/api.zava.run/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.zava.run/privkey.pem;

    client_max_body_size 64k;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

文档站

cd docs-site
python3 -m pip install -r requirements.txt
bash scripts/build.sh
ZAVA_DOCS_TARGET=root@example:/var/www/docs.zava.run/ bash scripts/deploy.sh

Nginx 静态站：

server {
    listen 443 ssl http2;
    server_name docs.zava.run;
    root /var/www/docs.zava.run;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}

DNS 的 docs.zava.run A/AAAA 记录必须先指向服务器，证书签发才能完成。域名未解析时 只能通过 Host header 验证服务器配置，禁止宣称公网 HTTPS 已上线。