数据留在自己机房，一台机器就能跑起来

/www/low-code/
├── releases/
│   └── 20260917-1730-0139fdd2/      # 一个发布版本一个目录
│       ├── low-code-platform        # 后端可执行文件
│       ├── frontend/dist/           # 前端静态资源（embed 模式可省）
│       ├── config.yaml              # 版本化配置（不含密钥）
│       ├── config.local.yaml -> /www/low-code/shared/config.local.yaml
│       └── RELEASE                  # 版本清单 JSON
├── channels/
│   ├── stable -> ../releases/20260917-1730-0139fdd2   # 正式版指针
│   └── stable.env                   # LC_SERVER_PORT=8710
├── shared/
│   ├── config.local.yaml            # 密钥，绝不随版本包分发
│   ├── data/                        # 数据与令牌密钥
│   └── uploads/                     # 上传的文件
└── current -> channels/stable

# 未写的键沿用 config.yaml，改了这里不用改版本包
server:
  port: 8710
  # base_path: "/lowcode"   # 无法传 X-Forwarded-Prefix 时固定部署前缀

redis:
  host: "127.0.0.1"
  port: 6379
  password: "你的 Redis 密码"

xdb2:
  url: "http://127.0.0.1:8091"

frontend:
  embed: false          # false=读磁盘 dist；true=前端内嵌进二进制
  dist_path: "frontend/dist"

message:
  http_whitelist: "192.168.2.0/24"   # 允许外呼的内网网段，留空则一律拒绝

[Unit]
Description=low-code platform (%i)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=/www/low-code/channels/%i
EnvironmentFile=/www/low-code/channels/%i.env
ExecStart=/www/low-code/channels/%i/low-code-platform
Restart=always
RestartSec=3
StandardOutput=journal
StandardError=journal
SyslogIdentifier=low-code-%i

[Install]
WantedBy=multi-user.target

# 启用并启动
systemctl daemon-reload
systemctl enable --now low-code@stable
systemctl status low-code@stable

# 看日志（排查启动失败先看这里）
journalctl -u low-code@stable -n 100 --no-pager

# 首选：公开接口，返回 200 即服务正常
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8710/api/v1/auth/providers

# 备用
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8710/api/v1/config/schema

# 反例：这个端点不存在，会返回 404，不要用它做探针
# curl http://127.0.0.1:8710/healthz

server {
    listen 443 ssl http2;
    server_name oss.example.com;

    ssl_certificate     /etc/nginx/ssl/example.crt;
    ssl_certificate_key /etc/nginx/ssl/example.key;

    location /lowcode/ {
        proxy_pass http://127.0.0.1:8710/;              # 尾部 / 必须有
        proxy_set_header X-Forwarded-Prefix /lowcode;  # 告知部署前缀
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;

        # 智能体对话使用 SSE，必须关闭缓冲并拉长超时
        proxy_buffering off;
        proxy_read_timeout 300s;

        # 上传文件大小限制（按需调整）
        client_max_body_size 50m;
    }

    # 兼容不带尾斜杠的访问
    location = /lowcode {
        return 301 /lowcode/;
    }
}

# 1. 新版本解包到独立目录（不影响正在运行的版本）
tar -xzf low-code-20260920.tar.gz -C /www/low-code/releases/20260920-1030-abc1234/
ln -s /www/low-code/shared/config.local.yaml \
      /www/low-code/releases/20260920-1030-abc1234/config.local.yaml

# 2. 切指针
ln -sfn ../releases/20260920-1030-abc1234 /www/low-code/channels/stable
systemctl restart low-code@stable

# 3. 健康检查
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8710/api/v1/auth/providers

# 4. 失败就回滚（切回上一个版本）
ln -sfn ../releases/20260917-1730-0139fdd2 /www/low-code/channels/stable
systemctl restart low-code@stable