# 三宝API deployment modifications

Version date: 2026-07-27

This deployment is based on New API `v1.0.0-rc.22`, commit
`bc14c18f6024e79cba1c08d02cd007796e12d668`.

The product-facing site name is configured as “三宝API”. The upstream
application identity, New API logo, copyright, notices, license, project link,
and the required attribution remain visible and unmodified. The footer
identifies the service as “Powered by New API” and links to the corresponding
source package.

No upstream Go or React source file is modified for the preview. Deployment
changes are limited to:

- isolated PostgreSQL and Redis instances;
- a loopback-only systemd service;
- secure environment and service hardening;
- preview-only runtime options (registration and payments disabled);
- an administrator-only SSH tunnel entry point;
- backup, restore, source packaging, and rollback scripts.
- removal of insecure fallback passwords and floating `latest` tags from the
  unused upstream Compose example.

The preview contains no customer account, balance, order, API key, media,
production provider credential, or private sanbao-video source.
## Preview verification channel

The deployment includes an optional loopback-only, deterministic OpenAI-compatible
mock service implemented with the Python standard library. It is used solely to verify gateway routing, token restrictions,
accounting logs, and UI statistics without copying production provider credentials
or incurring provider cost. It is not a production model provider.
## Hidden preview acceptance refinements

The loopback preview serves a responsive Sanbao API landing page and local
Chinese integration guide at `/` and `/docs`. The configured New API navigation
documentation link is `/docs`; the upstream official documentation remains a
supplementary link on that page. The preview reverse proxy adds nosniff,
referrer, permissions and anti-framing response headers. HSTS is intentionally
deferred until the formal HTTPS hostname is approved and enabled.