feat: 强化打包配置与服务安全

deploy.sh

@@ -18,6 +18,7 @@ if [ -f .env ]; then
 fi
 
 BACKEND_PORT="${BACKEND_PORT:-8000}"
+BIND_HOST="${BIND_HOST:-127.0.0.1}"
 WATCHDOG_INTERVAL="${WATCHDOG_INTERVAL:-30}"   # 健康检查间隔（秒）
 WATCHDOG_TIMEOUT="${WATCHDOG_TIMEOUT:-10}"     # 健康检查超时（秒）
 MAX_RESTART_ATTEMPTS="${MAX_RESTART_ATTEMPTS:-3}"  # 连续重启上限，超过则冷却
@@ -159,10 +160,12 @@ do_start() {
 
     mkdir -p "$LOG_DIR"
 
-    info "启动后端服务 (端口: $BACKEND_PORT)..."
+    info "启动后端服务 ($BIND_HOST:$BACKEND_PORT)..."
     nohup "$VENV_DIR/bin/python3" -m uvicorn backend.main:app \
-        --host 0.0.0.0 \
+        --host "$BIND_HOST" \
         --port "$BACKEND_PORT" \
+        --proxy-headers \
+        --forwarded-allow-ips 127.0.0.1 \
         --workers 1 \
         > "$LOG_DIR/server.log" 2>&1 &
 
@@ -170,11 +173,8 @@ do_start() {
     sleep 1
 
     if kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
-        local access_host
-        access_host=$(ipconfig getifaddr en0 2>/dev/null || true)
-        access_host="${access_host:-localhost}"
         info "服务已启动 (PID: $(cat "$PID_FILE"))"
-        info "访问地址: http://$access_host:$BACKEND_PORT"
+        info "访问地址: http://$BIND_HOST:$BACKEND_PORT"
     else
         error "启动失败，请查看日志: $LOG_DIR/server.log"
         rm -f "$PID_FILE"
@@ -382,8 +382,10 @@ do_watchdog_loop() {
             setup_venv
             mkdir -p "$LOG_DIR"
             nohup "$VENV_DIR/bin/python3" -m uvicorn backend.main:app \
-                --host 0.0.0.0 \
+                --host "$BIND_HOST" \
                 --port "$BACKEND_PORT" \
+                --proxy-headers \
+                --forwarded-allow-ips 127.0.0.1 \
                 --workers 1 \
                 >> "$LOG_DIR/server.log" 2>&1 &
             echo $! > "$PID_FILE"