Polish generic NAS deployment template

- Rework docker-compose-Nas.yaml as a QNAP/NAS-friendly generic template with placeholders for NAS IP, public domain, proxy, and secrets.

- Preserve QNAP-specific fixes including relative build context, api network alias, NAS persistent paths, and 127.0.0.1 health checks.

- Keep optional frpc profile while avoiding real server addresses or tokens in the reusable template.

- Replace residual deployment examples with generic your-domain.example, NAS_IP, PROXY_IP, and LAN_CIDR placeholders in README and Docker docs.

docker-compose-Nas.yaml

@@ -1,5 +1,5 @@
-# XXX QNAP/NAS deployment compose. Designed for Container Station or docker compose on a NAS.
-# XXX Edit /share paths, proxy variables, SESSION_SECRET, and frpc/frpc.toml before public deployment.
+# XXX 威联通/QNAP NAS 部署模板。
+# XXX 使用前建议复制一份 .env，按实际 NAS IP、域名、代理和密钥修改变量。
 
 services:
   tuwen_db:
@@ -11,7 +11,7 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-surclaw}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-surclaw_dev_password}
     volumes:
-      # XXX NAS persistent database directory. Change this path if your QNAP share is different.
+      # XXX 默认适配威联通 Container 共享目录；如目录不同，修改 NAS_DATA_ROOT。
       - ${NAS_DATA_ROOT:-/share/Container/tuwen_system_v2/data}/postgres:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-surclaw} -d $${POSTGRES_DB:-surclaw}"]
@@ -21,38 +21,38 @@ services:
 
   tuwen_api:
     build:
-      # XXX Keep relative context for QNAP, otherwise Container Station may fail to resolve absolute paths.
+      # XXX 威联通 Container Station 对绝对路径解析不稳定，保持相对 context。
       context: .
       dockerfile: Dockerfile.server
       args:
         HTTP_PROXY: ${HTTP_PROXY:-}
         HTTPS_PROXY: ${HTTPS_PROXY:-}
-        NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,192.168.31.0/24,tuwen_db,tuwen_api,tuwen_web,api,db,web}
+        NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,tuwen_db,tuwen_api,tuwen_web,api,db,web}
     container_name: tuwen_api
     restart: unless-stopped
     networks:
       default:
         aliases:
-          # XXX nginx.conf proxies /api to http://api:3100, so NAS service keeps this alias.
+          # XXX nginx.conf 中 /api 固定代理到 http://api:3100，NAS 服务需要保留该别名。
           - api
     depends_on:
       tuwen_db:
         condition: service_healthy
     ports:
-      # XXX Optional host API port for NAS diagnostics; public users should enter through web:4002/NPM.
+      # XXX API 诊断端口；公网访问应走 web:4002/Nginx Proxy Manager。
       - "${NAS_API_PORT:-4102}:3100"
     volumes:
-      # XXX NAS persistent upload directory for signatures, videos, keyframes, and template images.
+      # XXX 持久化签名、视频、关键帧和模板图片等上传文件。
       - ${NAS_DATA_ROOT:-/share/Container/tuwen_system_v2/data}/uploads:/app/uploads
     environment:
       NODE_ENV: production
       API_PORT: 3100
       API_BODY_LIMIT: ${API_BODY_LIMIT:-100mb}
       DATABASE_URL: postgresql://${POSTGRES_USER:-surclaw}:${POSTGRES_PASSWORD:-surclaw_dev_password}@tuwen_db:5432/${POSTGRES_DB:-surclaw}?schema=public
-      CORS_ORIGIN: ${CORS_ORIGIN:-http://192.168.31.5:4002,https://sstwbg.example.com}
-      # XXX Replace in NAS .env or Container Station variables before real deployment.
+      # XXX 示例：CORS_ORIGIN=http://NAS_IP:4002,https://your-domain.example
+      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:4002,https://localhost:4443}
+      # XXX 生产环境必须替换；公网 HTTPS 入口建议同时设置 SESSION_COOKIE_SECURE=true 和 TRUST_PROXY=true。
       SESSION_SECRET: ${SESSION_SECRET:-change-me-in-production}
-      # XXX For public HTTPS through Nginx Proxy Manager, set SESSION_COOKIE_SECURE=true and TRUST_PROXY=true.
       SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-false}
       TRUST_PROXY: ${TRUST_PROXY:-false}
       FILE_STORAGE_DIR: /app/uploads
@@ -64,9 +64,9 @@ services:
       HTTPS_PROXY: ${HTTPS_PROXY:-}
       http_proxy: ${HTTP_PROXY:-}
       https_proxy: ${HTTPS_PROXY:-}
-      NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,192.168.31.0/24,tuwen_db,tuwen_api,tuwen_web,api,db,web}
+      NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,tuwen_db,tuwen_api,tuwen_web,api,db,web}
     healthcheck:
-      # XXX Use 127.0.0.1 instead of localhost to avoid IPv6 resolution issues on some NAS firmware.
+      # XXX 使用 127.0.0.1，规避部分 NAS 固件中 localhost 优先解析 IPv6 的问题。
       test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3100/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
       interval: 10s
       timeout: 5s
@@ -75,13 +75,12 @@ services:
 
   tuwen_web:
     build:
-      # XXX Keep relative context for QNAP.
       context: .
       dockerfile: Dockerfile
       args:
         HTTP_PROXY: ${HTTP_PROXY:-}
         HTTPS_PROXY: ${HTTPS_PROXY:-}
-        NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,192.168.31.0/24,tuwen_db,tuwen_api,tuwen_web,api,db,web}
+        NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,tuwen_db,tuwen_api,tuwen_web,api,db,web}
     container_name: tuwen_web
     restart: unless-stopped
     depends_on:
@@ -89,10 +88,10 @@ services:
         condition: service_healthy
     ports:
       - "${NAS_WEB_PORT:-4002}:80"
-      # XXX Local self-signed HTTPS demo only. Public HTTPS should be handled by Nginx Proxy Manager.
+      # XXX 仅用于本机自签名 HTTPS 演示；公网 HTTPS 应由 Nginx Proxy Manager 提供。
       - "${NAS_HTTPS_DEMO_PORT:-4443}:443"
     environment:
-      APP_URL: ${APP_URL:-http://192.168.31.5:4002}
+      APP_URL: ${APP_URL:-http://localhost:4002}
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1/ || exit 1"]
       interval: 10s
@@ -100,7 +99,7 @@ services:
       retries: 6
 
   frpc:
-    # XXX Optional public tunnel client. Edit frpc/frpc.toml before enabling this profile.
+    # XXX 可选公网隧道客户端。启用前先编辑 frpc/frpc.toml。
     image: snowdreamtech/frpc:latest
     container_name: tuwen_frpc
     restart: unless-stopped