功能：新增云管API与Web控制台并完成现场接入

deploy/.gitkeep

@@ -1 +0,0 @@
-# Keep the monorepo directory structure in Git.

deploy/compose.dev.yml

@@ -0,0 +1,44 @@
+name: vdi-cloud-dev
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: vdi
+      POSTGRES_PASSWORD: vdi-local-demo
+      POSTGRES_DB: vdi
+    ports:
+      - "127.0.0.1:55438:5432"
+    volumes:
+      - vdi-postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U vdi -d vdi"]
+      interval: 3s
+      timeout: 3s
+      retries: 20
+  api:
+    build:
+      context: ..
+      dockerfile: platform/Dockerfile
+    environment:
+      VDI_MODE: demo
+      VDI_LISTEN: 0.0.0.0:8080
+      VDI_JWT_SECRET: local-demo-only-change-before-any-production-use-2026
+      DATABASE_URL: postgres://vdi:vdi-local-demo@postgres:5432/vdi?sslmode=disable
+    ports:
+      - "127.0.0.1:${VDI_API_PORT:-8088}:8080"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    init: true
+  console:
+    build:
+      context: ..
+      dockerfile: console/Dockerfile
+      args:
+        VITE_DEMO_HINT: "true"
+    ports:
+      - "127.0.0.1:${VDI_CONSOLE_PORT:-5180}:80"
+    depends_on:
+      - api
+volumes:
+  vdi-postgres:

deploy/compose.live.yml

@@ -0,0 +1,59 @@
+name: vdi-cloud-live
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: vdi
+      POSTGRES_PASSWORD: ${VDI_DB_PASSWORD:?required}
+      POSTGRES_DB: vdi_live
+    volumes:
+      - vdi-live-postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U vdi -d vdi_live"]
+      interval: 3s
+      timeout: 3s
+      retries: 20
+  api:
+    image: vdi-cloud-live-api
+    build:
+      context: ..
+      dockerfile: platform/Dockerfile
+    restart: unless-stopped
+    init: true
+    extra_hosts:
+      - "${PVE_HOSTNAME:?required}:${PVE_HOST_IP:?required}"
+    environment:
+      VDI_MODE: production
+      VDI_LISTEN: 0.0.0.0:8080
+      VDI_JWT_SECRET: ${VDI_JWT_SECRET:?required}
+      VDI_ADMIN_USERNAME: ${VDI_ADMIN_USERNAME:?required}
+      VDI_ADMIN_PASSWORD: ${VDI_ADMIN_PASSWORD:?required}
+      DATABASE_URL: postgres://vdi:${VDI_DB_PASSWORD}@postgres:5432/vdi_live?sslmode=disable
+      PVE_URL: ${PVE_URL:?required}
+      PVE_TOKEN_ID: ${PVE_TOKEN_ID:?required}
+      PVE_TOKEN_SECRET: ${PVE_TOKEN_SECRET:?required}
+      PVE_CA_FILE: /run/secrets/pve-ca.pem
+    volumes:
+      - ../.local/live/pve-ca.pem:/run/secrets/pve-ca.pem:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+  console:
+    image: vdi-cloud-live-console
+    build:
+      context: ..
+      dockerfile: console/Dockerfile
+      args:
+        VITE_DEMO_HINT: "false"
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:${VDI_LIVE_CONSOLE_PORT:-5182}:80"
+      - "${VDI_LIVE_BIND_IP:?required}:${VDI_LIVE_HTTPS_PORT:-8443}:443"
+    volumes:
+      - ./nginx.live.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../.local/live/tls:/run/secrets/tls:ro
+    depends_on:
+      - api
+volumes:
+  vdi-live-postgres:

deploy/nginx.conf

@@ -0,0 +1,13 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+  client_max_body_size 1m;
+  add_header X-Content-Type-Options nosniff always;
+  add_header Referrer-Policy same-origin always;
+  add_header X-Frame-Options DENY always;
+  location /api/ { proxy_pass http://api:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  location /healthz { proxy_pass http://api:8080; }
+  location / { try_files $uri $uri/ /index.html; }
+}

deploy/nginx.live.conf

@@ -0,0 +1,17 @@
+server {
+  listen 80;
+  listen 443 ssl;
+  ssl_certificate /run/secrets/tls/server.pem;
+  ssl_certificate_key /run/secrets/tls/server-key.pem;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+  client_max_body_size 1m;
+  add_header X-Content-Type-Options nosniff always;
+  add_header Referrer-Policy same-origin always;
+  add_header X-Frame-Options DENY always;
+  location /api/ { proxy_pass http://api:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; }
+  location /healthz { proxy_pass http://api:8080; }
+  location / { try_files $uri $uri/ /index.html; }
+}