Commit inicial - upload de todos os arquivos da pasta

deploy/lernotafiscal.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Lernotafiscal (FastAPI/Uvicorn)
+After=network.target
+
+[Service]
+Type=simple
+User=lernotafiscal
+Group=lernotafiscal
+WorkingDirectory=/opt/lernotafiscal
+EnvironmentFile=/opt/lernotafiscal/.env
+ExecStart=/opt/lernotafiscal/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 2
+Restart=on-failure
+RestartSec=3
+# Hardening básico
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ReadWritePaths=/opt/lernotafiscal/data
+
+[Install]
+WantedBy=multi-user.target

deploy/nginx.conf

@@ -0,0 +1,21 @@
+# Nginx como proxy reverso do Lernotafiscal.
+# Copie para /etc/nginx/sites-available/lernotafiscal, ajuste server_name e
+# habilite com: ln -s .../sites-available/lernotafiscal /etc/nginx/sites-enabled/
+# Depois rode `certbot --nginx -d seu.dominio.com` para gerar o bloco TLS/443.
+
+server {
+    listen 80;
+    server_name seu.dominio.com;
+
+    # Precisa acomodar MAX_UPLOAD_BYTES (12 MB por padrão) + folga do multipart.
+    client_max_body_size 16m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+}