deploy: enable trusted HTTPS IP endpoint

deploy/keycloak/realm-voice-local.json

@@ -19,6 +19,7 @@
         "http://localhost:3100/*",
         "http://127.0.0.1:3100/*",
         "http://121.41.46.238/*",
+        "https://121.41.46.238/*",
         "http://localhost:5173/*",
         "http://127.0.0.1:5173/*"
       ],
@@ -26,6 +27,7 @@
         "http://localhost:3100",
         "http://127.0.0.1:3100",
         "http://121.41.46.238",
+        "https://121.41.46.238",
         "http://localhost:5173",
         "http://127.0.0.1:5173"
       ],

deploy/server/README.md

@@ -1,12 +1,12 @@
 # 阿里云单机演示部署
 
-该配置用于单机公网演示，不是生产验收配置。只向公网发布HTTP 80；PostgreSQL、Redis、MinIO、Keycloak内部端口以及API/Worker端口均不映射到宿主机。真实RTC、模型、内容安全、HTTPS、云KMS、备份恢复和监控告警仍按阶段8验收清单执行。
+该配置用于单机公网演示，不是生产验收配置。只向公网发布HTTP 80和HTTPS 443；PostgreSQL、Redis、MinIO、Keycloak内部端口以及API/Worker端口均不映射到宿主机。当前阿里云演示机使用Let's Encrypt短期IP证书，`certbot-ip-renew.timer`负责自动续期。真实RTC、模型、内容安全、云KMS、备份恢复和监控告警仍按阶段8验收清单执行。
 
 服务器至少需要Docker Engine 29与Compose 2.40。首次部署先生成权限为600的服务器专用配置：
 
 ```sh
 ./deploy/server/bootstrap-secrets.sh \
-  http://SERVER_IP \
+  https://SERVER_IP \
   0.64.0-rc.cloud1 \
   FULL_GIT_COMMIT \
   2026-08-26T00:00:00Z
@@ -21,4 +21,4 @@ docker compose -f compose.yaml -f deploy/server/compose.override.yaml \
   mock-provider api worker web gateway
 ```
 
-安全组和主机防火墙只保留TCP 80以及受限来源的SSH 22。使用域名前只能运行HTTP演示；正式环境必须配置域名、受信HTTPS证书、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。
+安全组和主机防火墙只保留TCP 80、443以及受限来源的SSH 22。正式环境仍应配置自有域名、生产OIDC和真实外部服务，并切换到Kubernetes生产覆盖层。

deploy/server/certbot-ip-renew.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Renew the data terminal cloud IP certificate
+After=docker.service network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+WorkingDirectory=/opt/data-terminal-cloud/current
+ExecStart=/opt/certbot-5-runtime/bin/certbot renew --cert-name 121.41.46.238 --quiet --pre-hook "/usr/bin/docker compose -f compose.yaml -f deploy/server/compose.override.yaml --env-file deploy/server/.env stop gateway" --post-hook "/usr/bin/docker compose -f compose.yaml -f deploy/server/compose.override.yaml --env-file deploy/server/.env start gateway"
+

deploy/server/certbot-ip-renew.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check the data terminal cloud IP certificate twice daily
+
+[Timer]
+OnCalendar=*-*-* 03,15:17:00
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+

deploy/server/compose.override.yaml

@@ -15,7 +15,7 @@ x-server-backend-environment: &server-backend-environment
   OBJECT_STORE_SECRET_KEY: ${MINIO_SECRET_KEY}
   OBJECT_STORE_EXPORT_BUCKET: private-exports
   OBJECT_STORE_REGION: us-east-1
-  OBJECT_STORE_SECURE: "false"
+  OBJECT_STORE_SECURE: "true"
   CURSOR_SIGNING_SECRET: ${CURSOR_SIGNING_SECRET}
   SHARE_TOKEN_SIGNING_SECRET: ${SHARE_TOKEN_SIGNING_SECRET}
   EMBEDDING_PROVIDER: local
@@ -159,8 +159,10 @@ services:
     image: nginx:1.30-alpine
     ports:
       - "80:80"
+      - "443:443"
     volumes:
       - ./deploy/server/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro
     depends_on:
       - api
       - callbacks

deploy/server/nginx.conf

@@ -1,9 +1,23 @@
 server {
     listen 80;
     server_name _;
+    return 301 https://121.41.46.238$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name 121.41.46.238;
     server_tokens off;
     client_max_body_size 256m;
 
+    ssl_certificate /etc/letsencrypt/live/121.41.46.238/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/121.41.46.238/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+
+    add_header Strict-Transport-Security "max-age=31536000" always;
+
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Host $http_host;
@@ -46,4 +60,3 @@ server {
         proxy_pass http://web:8080;
     }
 }
-