feat(#91): 生产环境部署方案 - 服务器初始化/Nginx HTTPS/compose生产覆盖/备份策略+文档

deploy/production/server-setup.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 生产服务器初始化（Issue #91）：系统更新 / Docker / 防火墙 / SSH 加固 / 部署用户
+set -euo pipefail
+
+log() { echo "[setup] $*"; }
+
+log "系统更新"
+apt-get update && apt-get -y upgrade
+
+log "安装 Docker 与 compose 插件"
+if ! command -v docker >/dev/null; then
+  curl -fsSL https://get.docker.com | sh
+  systemctl enable --now docker
+fi
+
+log "创建部署用户 deploy（非 root 运行）"
+id -u deploy >/dev/null 2>&1 || useradd -m -s /bin/bash deploy
+usermod -aG docker deploy
+mkdir -p /opt/wms && chown deploy:deploy /opt/wms
+
+log "防火墙：仅放行 22/80/443"
+if command -v ufw >/dev/null; then
+  ufw default deny incoming
+  ufw default allow outgoing
+  ufw allow 22/tcp
+  ufw allow 80/tcp
+  ufw allow 443/tcp
+  ufw --force enable
+fi
+
+log "SSH 加固"
+sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+systemctl reload sshd || true
+
+log "时间同步"
+timedatectl set-timezone Asia/Shanghai
+
+log "完成。请将 TLS 证书放入 /opt/wms/deploy/production/certs/ 后执行 scripts/deploy.sh"