From 80d2716b7c047055d3f1f3caf5785883a22653ed Mon Sep 17 00:00:00 2001
From: v6ole <voole@vip.qq.com>
Date: Tue, 28 Jul 2026 17:38:45 +0800
Subject: [PATCH] deploy: manage backend with systemd

---
 deploy/systemd/qiji-backend.service | 24 ++++++++++++++++++++++++
 docs/发布与回滚检查表.md            |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 deploy/systemd/qiji-backend.service

diff --git a/deploy/systemd/qiji-backend.service b/deploy/systemd/qiji-backend.service
new file mode 100644
index 0000000..1257e10
--- /dev/null
+++ b/deploy/systemd/qiji-backend.service
@@ -0,0 +1,24 @@
+[Unit]
+Description=Qiji backend API
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=v6ole
+Group=v6ole
+WorkingDirectory=/home/v6ole/pyproject/qiji/backend
+EnvironmentFile=/home/v6ole/pyproject/qiji/backend/.env
+Environment=PYTHONDONTWRITEBYTECODE=1
+ExecStart=/home/v6ole/pyproject/qiji/backend/.venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8002
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectKernelTunables=true
+ProtectControlGroups=true
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
diff --git a/docs/发布与回滚检查表.md b/docs/发布与回滚检查表.md
index 3d0c0df..67c0915 100644
--- a/docs/发布与回滚检查表.md
+++ b/docs/发布与回滚检查表.md
@@ -30,7 +30,7 @@ alembic current
 ## 3. 发布与验证
 
 - [ ] 使用指定 Tag/镜像摘要部署；禁止直接从未审核工作区运行。
-- [ ] 服务以受控进程或编排平台运行，未使用开发热重载。
+- [ ] 服务以受控 systemd 服务或编排平台运行，未使用开发热重载。
 - [ ] 仅反向代理对公网开放 HTTPS；数据库、缓存、MinIO 管理端口不对公网监听。
 - [ ] 健康检查通过：`GET /health`。
 - [ ] 回归登录、角色授权、企微绑定、受控图片上传和图片下载授权。