• ENABLE_HTTP_SYNC=false: the HTTP sync and sync-status endpoints return 404.
• Run synchronization locally with docker compose exec douban-api pnpm sync.
• PUBLIC_INCLUDE_NOTES=false: personal notes are omitted from the public API.
• The container binds port 3006 to host loopback only and runs as a non-root user.

Generate a sync token only when HTTP sync is explicitly required:

openssl rand -hex 32

Keep .env readable only by the deployment account:

chmod 600 .env

Do not put credentials in source code, Docker images, URLs, screenshots, or support logs. Rotate a token or credential immediately after suspected exposure.

The safest public configuration blocks management endpoints:

location = /dbApi/api/sync {
    return 404;
}

location = /dbApi/api/sync/status {
    return 404;
}

location /dbApi/ {
    proxy_pass http://127.0.0.1:3006/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

If remote synchronization is unavoidable, protect both management endpoints with an IP allowlist or an identity-aware proxy, enable HTTPS only, and add Nginx request limiting. Do not expose the sync token in query parameters.

• Do not expose port 3306 to the public internet.
• Restrict the cloud security group and host firewall to the Docker subnet and trusted administrative sources.
• Use a runtime account limited to SELECT, INSERT, and UPDATE on the application database.
• Use a separate administrative account for pnpm db:init.
• Prefer an SSH tunnel for remote database administration.

Run dependency checks before deployment:

pnpm audit

Rebuild the container after source changes:

docker compose build --no-cache
docker compose up -d --force-recreate