feat: 优化集群部署与堡垒机接入 (#106)

支持受限网络、正向代理、私有 CA 与 SSH 堡垒机部署 Agent。

加固 Docker、systemd、Nginx、安装器、Release 校验与可信代理边界，并完善命令队列索引、前端安装向导及中英文运维文档。

docs-site/docs/deployment/docker.md

@@ -1,81 +1,96 @@
 ---
 sidebar_position: 1
 title: Docker Deployment
-description: Production-style Docker deployment with docker compose, mounted source directories, and environment overrides.
+description: Hardened single-process Docker deployment with health checks and persistent data.
 ---
 
 # Docker Deployment
 
-BackupX's official Docker image [`awuqing/backupx`](https://hub.docker.com/r/awuqing/backupx) supports multi-architecture (linux/amd64 + linux/arm64).
+The official [`awuqing/backupx`](https://hub.docker.com/r/awuqing/backupx) image supports `linux/amd64` and `linux/arm64`.
 
 ## Compose file
 
 ```yaml title="docker-compose.yml"
 services:
   backupx:
-    image: awuqing/backupx:latest
+    image: ${BACKUPX_IMAGE:-awuqing/backupx:latest}
     container_name: backupx
     restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
     ports:
-      - "8340:8340"
+      - "${BACKUPX_BIND_ADDRESS:-0.0.0.0}:${BACKUPX_PORT:-8340}:8340"
     volumes:
       - backupx-data:/app/data
-      # Mount host directories you want to back up:
-      - /var/www:/mnt/www:ro
-      - /etc/nginx:/mnt/nginx-conf:ro
+      # - /var/www:/mnt/www:ro
+      # - /etc/nginx:/mnt/nginx-conf:ro
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - SETGID
+      - SETUID
     environment:
-      - TZ=Asia/Shanghai
-      # Required when remote Agents must connect through a public or routed URL:
-      # - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
-      - BACKUPX_LOG_LEVEL=info
-      - BACKUPX_BACKUP_MAX_CONCURRENT=2
+      TZ: Asia/Shanghai
+      # BACKUPX_SERVER_EXTERNAL_URL: https://backup.example.com
+      BACKUPX_LOG_LEVEL: info
+      BACKUPX_BACKUP_MAX_CONCURRENT: "2"
+    healthcheck:
+      test: ["CMD", "su-exec", "backupx:backupx", "wget", "-q", "-T", "3", "-O", "/dev/null", "http://127.0.0.1:8340/ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
 
 volumes:
   backupx-data:
 ```
 
-Start with:
-
 ```bash
 docker compose up -d
+docker compose ps
 ```
 
-## Host-directory backup
+The entrypoint uses root only to migrate ownership of data written by older images, then starts one unprivileged `backupx` process. Compose retains only the ownership and UID/GID transition capabilities needed for that initialization. The backend serves both the API and built web assets; the image neither mounts the Docker socket nor bundles a Docker CLI. Pin `BACKUPX_IMAGE` to a release tag in production.
 
-To back up files from the host, mount them into the container. When creating a file-type task in the web UI, point the source path at the mount location (e.g. `/mnt/www`). Make sure the directory is visible inside the container.
+## Host-directory backups
 
-## Multi-node clusters
+Mount each source directory and use its container path in the task. The container's `backupx` user must be able to read it; restore destinations need a separate, narrowly scoped writable mount. Prefer a remote Agent for privileged host paths. If a Master-side task truly requires root, make that exception explicit with `user: "0:0"` and review every mount.
 
-When deploying Agents on other machines, set `BACKUPX_SERVER_EXTERNAL_URL` on the Master container to the URL that those Agents can reach:
+## Multi-node cluster
+
+Set the stable URL that Agents can reach:
 
 ```yaml
 environment:
-  - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
+  BACKUPX_SERVER_EXTERNAL_URL: https://backup.example.com
 ```
 
-Use an HTTPS URL if Agents cross untrusted networks. The generated one-click install scripts and docker-compose snippets use this value as `BACKUPX_AGENT_MASTER`.
+Use HTTPS across untrusted networks. Proxy, private-CA, and SSH-bastion deployments are covered in [Multi-Node Cluster](../features/multi-node).
 
-## Environment variables
+If an external reverse proxy is in another container, add only its bridge subnet to `BACKUPX_SERVER_TRUSTED_PROXIES`, for example `172.18.0.0/16`. Do not trust every address.
 
-All configuration keys can be overridden with the `BACKUPX_` prefix:
+## Environment overrides
 
 ```yaml
 environment:
-  - TZ=Asia/Shanghai
-  - BACKUPX_SERVER_PORT=8340
-  - BACKUPX_LOG_LEVEL=debug
-  - BACKUPX_BACKUP_MAX_CONCURRENT=4
-  - BACKUPX_BACKUP_TEMP_DIR=/tmp/backupx
+  TZ: Asia/Shanghai
+  BACKUPX_LOG_LEVEL: debug
+  BACKUPX_BACKUP_MAX_CONCURRENT: "4"
+  BACKUPX_BACKUP_TEMP_DIR: /tmp/backupx
 ```
 
-See the [Configuration](./configuration) page for the full list.
+The image's internal port is fixed at `8340`; change only the published host port with `BACKUPX_PORT`.
 
-## Upgrades
-
-Check **System Settings → Check Updates** in the UI to see if a new version is available, then on the host:
+## Upgrade and rollback preparation
 
 ```bash
-docker compose pull && docker compose up -d
+docker compose pull
+docker compose up -d
+docker compose ps
 ```
 
-No migrations needed — BackupX auto-migrates the SQLite schema on startup.
+Wait for `healthy` before switching traffic or removing an old deployment. Before upgrades, stop the Master for a file-level copy or take an atomic snapshot of the entire `backupx-data` volume. Keep exactly one active Master for a data volume; SQLite does not support multiple Master containers sharing `/app/data`.