feat: 优化集群部署与堡垒机接入 (#106)

支持受限网络、正向代理、私有 CA 与 SSH 堡垒机部署 Agent。

加固 Docker、systemd、Nginx、安装器、Release 校验与可信代理边界，并完善命令队列索引、前端安装向导及中英文运维文档。

docs-site/docs/deployment/bare-metal.md

@@ -1,7 +1,7 @@
 ---
 sidebar_position: 2
 title: Bare-metal Deployment
-description: systemd + Nginx deployment from the prebuilt release tarball or source.
+description: Hardened systemd deployment from the prebuilt release tarball or source, with opt-in Nginx.
 ---
 
 # Bare-metal Deployment
@@ -11,6 +11,8 @@ description: systemd + Nginx deployment from the prebuilt release tarball or sou
 ```bash
 # Download the matching tarball
 curl -LO https://github.com/Awuqing/BackupX/releases/latest/download/backupx-linux-amd64.tar.gz
+curl -LO https://github.com/Awuqing/BackupX/releases/latest/download/backupx-linux-amd64.tar.gz.sha256
+sha256sum -c backupx-linux-amd64.tar.gz.sha256
 
 # Extract and install
 tar xzf backupx-linux-amd64.tar.gz && cd backupx-*-linux-amd64
@@ -23,9 +25,17 @@ The installer performs these steps automatically:
 2. Copies the binary to `/opt/backupx/bin/backupx` and the web console to `/opt/backupx/web`
 3. Installs the default configuration at `/etc/backupx/config.yaml`
 4. Installs `backupx.service` (systemd), enabled at boot
-5. (Optional) installs an Nginx site file — see [Nginx Reverse Proxy](./nginx)
+5. Leaves Nginx unchanged unless `INSTALL_NGINX=1` is explicitly requested
 6. Verifies the first-setup API before reporting success
 
+The executable and web assets are owned by root; only `/opt/backupx/data` is writable by the `backupx` service account. `/etc/backupx/config.yaml` is installed as `root:backupx` with mode `0640`.
+
+The bundled Nginx template is a starting point and may conflict with an existing default server. Review its hostname and TLS policy first, then opt in:
+
+```bash
+sudo INSTALL_NGINX=1 ./install.sh
+```
+
 For multi-node clusters, edit `/etc/backupx/config.yaml` after installation and set the Master URL that remote Agents can reach:
 
 ```yaml
@@ -70,6 +80,7 @@ ExecStart=/opt/backupx/bin/backupx -config /etc/backupx/config.yaml
 Restart=on-failure
 RestartSec=5
 NoNewPrivileges=true
+UMask=0027
 LimitNOFILE=65535
 
 [Install]
@@ -87,6 +98,8 @@ curl -fsS http://127.0.0.1:8340/api/auth/setup/status
 
 Open `http://your-server:8340`, switch to English if desired, and create the first administrator on the **System setup** screen. For a custom listen port, run the installer with a matching `HEALTH_URL`.
 
+For production, expose BackupX through HTTPS or restrict port `8340` at the firewall. The installer does not make firewall changes.
+
 ## Password reset
 
 If the admin password is lost: