Normalize deployment and operations

[CyrusAuyeung]

Summary

Normalize the public Blindot API deployment repository around an explicit configuration-v2 contract, safer single-host defaults, a hardened and testable SMTP-to-Brevo relay, repeatable validation, and operations-focused documentation.

What changed

• Refactored the Compose stack with pinned image defaults, loopback application binding, health checks, log rotation, graceful shutdown settings, safer network ownership, and a mandatory v2 migration gate.
• Kept PostgreSQL on image defaults and aligned the application pool with the observed 4 GB single-host deployment instead of activating stale high-connection tuning.
• Hardened smtp2brevo with bounded inputs and timeouts, TLS 1.2+, constant-time credential checks, attachment rejection, privacy-safe structured logs, graceful shutdown, a TLS health check, locked dependencies, and seven unit tests.
• Added repository safety and deployment preflight scripts, a validation-only GitHub Actions workflow, Dependabot, Markdown rules, editor/line-ending policy, and stronger issue/PR templates.
• Reworked the bilingual README and deployment, configuration, architecture, migration, security, backup, upgrade, Nginx, SMTP, production-checklist, and operations documentation.

Why

The repository is the public deployment and operations layer, not the Sub2API core source. Its prior configuration mixed Compose interpolation with application settings that were not consistently injected, retained production-sized tuning values that were unsafe to activate blindly, encoded deployment-specific network details, and lacked a migration guard or automated validation. Configuration v2 makes that boundary explicit and prevents an existing private environment from being applied without review.

Impact and migration

• This PR contains no production deployment automation and does not change the VPS.
• Existing deployments must follow docs/migration-v2.md and explicitly set BLINDOT_DEPLOY_CONFIG_VERSION=2 before manually promoting these files.
• A deliberate future deployment can recreate containers to apply port binding, environment, network, logging, and relay-security changes; backup and rollback guidance is included.
• The Sub2API image remains pinned to weishaw/sub2api:0.1.113.

Validation

• npm ci --ignore-scripts
• npm run check
• npm test — 7/7 passed
• npm audit --omit=dev — 0 vulnerabilities
• npm ls --all and npm outdated
• Markdownlint 0.23.0 — 16 files, 0 errors
• Actionlint 1.7.12
• YAML/JSON syntax, environment-key uniqueness, local Markdown links, and git diff --check
• sh -n for both scripts
• sh scripts/check-public-safe.sh, including full Git-history checks
• Read-only Compose rendering on the deployment VPS, including the negative v2-gate test
• Live boundary check: /health returned 200 and unauthenticated /v1/models returned 401
• GitHub Actions will additionally execute the sanitized deployment preflight and build the relay image

Checklist

• No production secret, address, certificate, dump, or runtime data is included
• Documentation and examples are updated for behavior changes
• Relay checks and tests pass
• Compose rendering passes
• sh scripts/check-public-safe.sh passes

Notes

Pull requests and merges in this repository do not deploy production. Promotion remains an explicit operator action.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c336f1eca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".