docs: native Ubuntu install as primary; systemd and nginx

- install-ubuntu-24.04-native.md (production) and -docker.md (alternative)

- deploy/systemd/sac-api.service, nginx/sac.conf.example, env.native.example

- deployment, README, INDEX, work-plan, TZ updated

deploy/.env.example

@@ -1,4 +1,5 @@
-# Скопировать: cp .env.example .env  (или в /etc/security-alert-center/.env)
+# Только для Docker Compose (см. docs/install-ubuntu-24.04-docker.md).
+# Production native: deploy/env.native.example → /etc/security-alert-center/sac-api.env
 
 # PostgreSQL
 POSTGRES_USER=sac

deploy/README.md

@@ -1,10 +1,18 @@
 # Deploy
 
+## Production (native) — основной путь
+
+1. [docs/install-ubuntu-24.04-native.md](../docs/install-ubuntu-24.04-native.md)
+2. `deploy/env.native.example` → `/etc/security-alert-center/sac-api.env`
+3. `deploy/systemd/sac-api.service` → `/etc/systemd/system/`
+4. `deploy/nginx/sac.conf.example` → `/etc/nginx/sites-available/sac`
+
+## Альтернатива: Docker
+
+Только для стенда. См. [docs/install-ubuntu-24.04-docker.md](../docs/install-ubuntu-24.04-docker.md).
+
 ```bash
-cp .env.example .env
-nano .env
+cp .env.example .env   # docker-only
 docker compose up -d --build
 docker compose run --rm migrate
 ```
-
-Полная инструкция для Ubuntu 24.04: [../docs/install-ubuntu-24.04.md](../docs/install-ubuntu-24.04.md)

deploy/env.native.example

@@ -0,0 +1,19 @@
+# Native (systemd): скопировать в /etc/security-alert-center/sac-api.env
+# chmod 600 /etc/security-alert-center/sac-api.env
+# chown root:sac /etc/security-alert-center/sac-api.env
+
+DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:5432/sac
+
+SAC_PUBLIC_URL=https://sac.example.com
+JWT_SECRET=CHANGE_ME_openssl_rand_hex_32
+
+# API key для агентов: Authorization: Bearer <ключ>
+# python3.12 -c "import secrets; print('sac_'+secrets.token_urlsafe(32))"
+SAC_BOOTSTRAP_API_KEY=sac_replace_with_generated_key
+
+EVENT_SCHEMA_PATH=/opt/security-alert-center/schemas/event-schema-v1.json
+
+SAC_ADMIN_USERNAME=admin
+SAC_ADMIN_PASSWORD=
+
+CORS_ORIGINS=*

deploy/nginx/sac.conf.example

@@ -0,0 +1,44 @@
+# /etc/nginx/sites-available/sac
+# Замените sac.example.com на ваш FQDN.
+# API слушает только 127.0.0.1:8000 (systemd sac-api).
+
+upstream sac_api {
+    server 127.0.0.1:8000;
+    keepalive 8;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name sac.example.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name sac.example.com;
+
+    # После certbot пути подставятся автоматически, либо укажите вручную:
+    # ssl_certificate     /etc/letsencrypt/live/sac.example.com/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/sac.example.com/privkey.pem;
+
+    client_max_body_size 2m;
+
+    location / {
+        proxy_pass http://sac_api;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+    }
+}

deploy/systemd/sac-api.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Security Alert Center API (FastAPI)
+Documentation=https://git.kalinamall.ru/PapaTramp/security-alert-center
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/etc/security-alert-center/sac-api.env
+Environment=PYTHONPATH=/opt/security-alert-center/backend
+ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target