# OmniRoute — Deployment Guide on VM with Cloudflare (Bahasa Melayu)

🌐 **Languages:** 🇺🇸 [English](../../../../ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇹 [am](../../../am/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇦 [ar](../../../ar/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇦🇿 [az](../../../az/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇬 [bg](../../../bg/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇩 [bn](../../../bn/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇦 [bs](../../../bs/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇨🇿 [cs](../../../cs/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇩🇰 [da](../../../da/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇩🇪 [de](../../../de/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇬🇷 [el](../../../el/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇸 [es](../../../es/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇪 [et](../../../et/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇷 [fa](../../../fa/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇫🇮 [fi](../../../fi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇫🇷 [fr](../../../fr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇪 [ga](../../../ga/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [gu](../../../gu/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [ha](../../../ha/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇱 [he](../../../he/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [hi](../../../hi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇭🇷 [hr](../../../hr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇭🇺 [hu](../../../hu/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇦🇲 [hy](../../../hy/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇩 [id](../../../id/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [ig](../../../ig/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇹 [it](../../../it/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇯🇵 [ja](../../../ja/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇬🇪 [ka](../../../ka/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇭 [km](../../../km/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [kn](../../../kn/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇷 [ko](../../../ko/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇹 [lt](../../../lt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇻 [lv](../../../lv/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [ml](../../../ml/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [mr](../../../mr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇲🇹 [mt](../../../mt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇲🇲 [my](../../../my/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇵 [ne](../../../ne/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇱 [nl](../../../nl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇴 [no](../../../no/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [or](../../../or/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [pa](../../../pa/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇭 [phi](../../../phi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇱 [pl](../../../pl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇹 [pt](../../../pt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇷 [pt-BR](../../../pt-BR/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇴 [ro](../../../ro/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇺 [ru](../../../ru/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇰 [si](../../../si/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇰 [sk](../../../sk/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇮 [sl](../../../sl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇸 [sr](../../../sr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇪 [sv](../../../sv/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇪 [sw](../../../sw/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [ta](../../../ta/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [te](../../../te/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇭 [th](../../../th/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇷 [tr](../../../tr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇺🇦 [uk-UA](../../../uk-UA/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇰 [ur](../../../ur/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇺🇿 [uz](../../../uz/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇻🇳 [vi](../../../vi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [yo](../../../yo/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇨🇳 [zh-CN](../../../zh-CN/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇼 [zh-TW](../../../zh-TW/docs/ops/VM_DEPLOYMENT_GUIDE.md)

---

🌐 **Languages:** 🇺🇸 [English](../../../../ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇹 [am](../../../am/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇦 [ar](../../../ar/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇦🇿 [az](../../../az/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇬 [bg](../../../bg/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇩 [bn](../../../bn/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇦 [bs](../../../bs/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇨🇿 [cs](../../../cs/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇩🇰 [da](../../../da/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇩🇪 [de](../../../de/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇬🇷 [el](../../../el/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇸 [es](../../../es/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇪🇪 [et](../../../et/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇷 [fa](../../../fa/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇫🇮 [fi](../../../fi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇫🇷 [fr](../../../fr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇪 [ga](../../../ga/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [gu](../../../gu/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [ha](../../../ha/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇱 [he](../../../he/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [hi](../../../hi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇭🇷 [hr](../../../hr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇭🇺 [hu](../../../hu/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇦🇲 [hy](../../../hy/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇩 [id](../../../id/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [ig](../../../ig/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇹 [it](../../../it/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇯🇵 [ja](../../../ja/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇬🇪 [ka](../../../ka/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇭 [km](../../../km/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [kn](../../../kn/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇷 [ko](../../../ko/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇹 [lt](../../../lt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇻 [lv](../../../lv/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [ml](../../../ml/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [mr](../../../mr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇲🇹 [mt](../../../mt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇲🇲 [my](../../../my/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇵 [ne](../../../ne/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇱 [nl](../../../nl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇴 [no](../../../no/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [or](../../../or/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [pa](../../../pa/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇭 [phi](../../../phi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇱 [pl](../../../pl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇹 [pt](../../../pt/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇧🇷 [pt-BR](../../../pt-BR/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇴 [ro](../../../ro/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇺 [ru](../../../ru/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇱🇰 [si](../../../si/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇰 [sk](../../../sk/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇮 [sl](../../../sl/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇷🇸 [sr](../../../sr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇸🇪 [sv](../../../sv/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇰🇪 [sw](../../../sw/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [ta](../../../ta/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇮🇳 [te](../../../te/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇭 [th](../../../th/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇷 [tr](../../../tr/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇺🇦 [uk-UA](../../../uk-UA/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇵🇰 [ur](../../../ur/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇺🇿 [uz](../../../uz/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇻🇳 [vi](../../../vi/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇳🇬 [yo](../../../yo/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇨🇳 [zh-CN](../../../zh-CN/docs/ops/VM_DEPLOYMENT_GUIDE.md) · 🇹🇼 [zh-TW](../../../zh-TW/docs/ops/VM_DEPLOYMENT_GUIDE.md)

Panduan lengkap untuk memasang dan mengkonfigurasi OmniRoute pada VM (VPS) dengan domain yang diurus melalui Cloudflare.

---

## Prasyarat

| Item       | Minimum                   | Disyorkan        |
| ---------- | ------------------------- | ---------------- |
| **CPU**    | 1 vCPU                    | 2 vCPU           |
| **RAM**    | 1 GB                      | 2 GB             |
| **Cakera** | 10 GB SSD                 | 25 GB SSD        |
| **OS**     | Ubuntu 22.04 LTS          | Ubuntu 24.04 LTS |
| **Domain** | Didaftarkan di Cloudflare | —                |
| **Docker** | Docker Engine 24+         | Docker 27+       |

**Penyedia yang diuji**: Akamai (Linode), DigitalOcean, Vultr, Hetzner, AWS Lightsail.

---

## 1. Konfigurasikan VM

### 1.1 Cipta tika

Pada penyedia VPS pilihan anda:

- Pilih Ubuntu 24.04 LTS
- Pilih pelan minimum (1 vCPU / 1 GB RAM)
- Tetapkan kata laluan root yang kukuh atau konfigurasikan kunci SSH
- Catat **IP awam** (contohnya, `203.0.113.10`)

### 1.2 Sambung melalui SSH

```bash
ssh root@203.0.113.10
```

### 1.3 Kemas kini sistem

```bash
apt update && apt upgrade -y
```

### 1.4 Pasang Docker

```bash
# Pasang kebergantungan
apt install -y ca-certificates curl gnupg

# Tambahkan repositori rasmi Docker
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $ (. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
```

### 1.5 Pasang nginx

```bash
apt install -y nginx
```

### 1.6 Konfigurasikan Tembok Api (UFW)

```bash
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp    # SSH
ufw allow 80/tcp    # HTTP (ubah hala)
ufw allow 443/tcp   # HTTPS
ufw enable
```

> **Petua**: Untuk keselamatan maksimum, hadkan port 80 dan 443 kepada IP Cloudflare sahaja. Lihat bahagian [Keselamatan Lanjutan](#advanced-security).

---

## 2. Pasang OmniRoute

### 2.1 Cipta direktori konfigurasi

```bash
mkdir -p /opt/omniroute
```

### 2.2 Cipta fail pemboleh ubah persekitaran

```bash
cat > /opt/omniroute/.env << 'EOF'
# === Keselamatan ===
JWT_SECRET=CHANGE-TO-A-UNIQUE-64-CHAR-SECRET-KEY
INITIAL_PASSWORD=YourSecurePassword123!
API_KEY_SECRET=REPLACE-WITH-ANOTHER-SECRET-KEY
STORAGE_ENCRYPTION_KEY=REPLACE-WITH-THIRD-SECRET-KEY
STORAGE_ENCRYPTION_KEY_VERSION=v1
MACHINE_ID_SALT=CHANGE-TO-A-UNIQUE-SALT
OMNIROUTE_WS_BRIDGE_SECRET=REPLACE-WITH-WS-BRIDGE-SECRET  # DIPERLUKAN dalam persekitaran pengeluaran: digunakan oleh jambatan WS Codex Responses

# === Aplikasi ===
PORT=20128
NODE_ENV=production
HOSTNAME=0.0.0.0
DATA_DIR=/app/data
APP_LOG_TO_FILE=true
AUTH_COOKIE_SECURE=true
REQUIRE_API_KEY=false

# === URL (tukar kepada domain anda) ===
# URL asas dalaman antara pelayan untuk tugas berjadual / pengambilan kendiri.
BASE_URL=http://127.0.0.1:20128
# URL untuk pelayar yang digunakan bagi panggil balik OAuth, pautan papan pemuka dan URL awam yang dijana.
NEXT_PUBLIC_BASE_URL=https://llms.seudominio.com
# Penggantian asal awam eksplisit pilihan untuk URL aset awam yang dijana.
# OMNIROUTE_PUBLIC_BASE_URL=https://llms.seudominio.com

# === Penyegerakan Awan (pilihan) ===
# CLOUD_URL=https://cloud.omniroute.online
# NEXT_PUBLIC_CLOUD_URL=https://cloud.omniroute.online
EOF
```

> ⚠️ **PENTING**: Jana kunci rahsia yang unik! Gunakan `openssl rand -hex 32` untuk setiap kunci.

### 2.3 Mulakan bekas

```bash
docker pull diegosouzapw/omniroute:latest

docker run -d \
  --name omniroute \
  --restart unless-stopped \
  --env-file /opt/omniroute/.env \
  -p 20128:20128 \
  -v omniroute-data:/app/data \
  diegosouzapw/omniroute:latest
```

### 2.4 Sahkan bahawa ia sedang berjalan

```bash
docker ps | grep omniroute
docker logs omniroute --tail 20
```

Ia sepatutnya memaparkan: `[DB] SQLite database ready` dan `listening on port 20128`.

---

## 3. Konfigurasikan nginx (Proksi Songsang)

### 3.1 Jana sijil SSL (Cloudflare Origin)

Dalam papan pemuka Cloudflare:

1. Pergi ke **SSL/TLS → Origin Server**
2. Klik **Create Certificate**
3. Kekalkan tetapan lalai (15 tahun, \*.yourdomain.com)
4. Salin **Origin Certificate** dan **Private Key**

```bash
mkdir -p /etc/nginx/ssl

# Tampalkan sijil
nano /etc/nginx/ssl/origin.crt

# Tampalkan kunci peribadi
nano /etc/nginx/ssl/origin.key

chmod 600 /etc/nginx/ssl/origin.key
```

### 3.2 Konfigurasi Nginx

```bash
cat > /etc/nginx/sites-available/omniroute << 'NGINX'
# Pelayan lalai — menyekat akses terus melalui IP
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl_certificate     /etc/nginx/ssl/origin.crt;
    ssl_certificate_key /etc/nginx/ssl/origin.key;
    server_name _;
    return 444;
}

# OmniRoute — HTTPS
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name llms.yourdomain.com;  # Tukar kepada domain anda

    ssl_certificate     /etc/nginx/ssl/origin.crt;
    ssl_certificate_key /etc/nginx/ssl/origin.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    client_max_body_size 100M;

    location / {
        proxy_pass http://127.0.0.1:20128;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Sokongan WebSocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # SSE (Peristiwa Dihantar Pelayan) — penstriman respons AI
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}

# Ubah hala HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name llms.yourdomain.com;
    return 301 https://$server_name$request_uri;
}
NGINX
```

Pastikan tamat masa strim proksi songsang diselaraskan dengan pemboleh ubah persekitaran tamat masa OmniRoute anda. Jika anda meningkatkan
`FETCH_TIMEOUT_MS` / `STREAM_IDLE_TIMEOUT_MS`, tingkatkan `proxy_read_timeout` / `proxy_send_timeout`
melebihi ambang yang sama.

OmniRoute menggunakan `NEXT_PUBLIC_BASE_URL` sebagai asal kanonik yang menghadap pelayar untuk panggil balik OAuth
dan pautan awam yang dijana. Operasi tulis papan pemuka yang disahkan menggunakan permintaan asal yang sama
serta perlindungan CSRF terikat sesi, jadi operasi tersebut tidak memerlukan URL asas awam yang statik. Pengepala
`X-Forwarded-*` di atas masih merupakan metadata penghalaan yang berguna, tetapi ia bukan pengganti
untuk menetapkan URL awam secara eksplisit apabila OAuth atau pautan pelayar yang dijana memerlukannya. Dayakan
`OMNIROUTE_TRUST_PROXY` hanya jika OmniRoute tidak boleh dicapai secara langsung oleh klien dan proksi anda
membuang/membina semula pengepala pemajuan yang masuk.

### 3.3 Dayakan dan Uji

```bash
# Alih keluar konfigurasi lalai
rm -f /etc/nginx/sites-enabled/default

# Dayakan OmniRoute
ln -sf /etc/nginx/sites-available/omniroute /etc/nginx/sites-enabled/omniroute

# Uji dan muat semula
nginx -t && systemctl reload nginx
```

---

## 4. Konfigurasikan DNS Cloudflare

### 4.1 Tambahkan rekod DNS

Dalam papan pemuka Cloudflare → DNS:

| Jenis | Nama   | Kandungan              | Proksi         |
| ----- | ------ | ---------------------- | -------------- |
| A     | `llms` | `203.0.113.10` (IP VM) | ✅ Diproksikan |

### 4.2 Konfigurasikan SSL

Di bawah **SSL/TLS → Gambaran Keseluruhan**:

- Mod: **Penuh (Ketat)**

Di bawah **SSL/TLS → Sijil Edge**:

- Sentiasa Gunakan HTTPS: ✅ Aktif
- Versi TLS Minimum: TLS 1.2
- Penulisan Semula HTTPS Automatik: ✅ Aktif

### 4.3 Pengujian

```bash
curl -sI https://llms.seudominio.com/health
# Seharusnya mengembalikan HTTP/2 200
```

---

## 5. Operasi dan Penyelenggaraan

### Naik taraf kepada versi baharu

```bash
docker pull diegosouzapw/omniroute:latest
docker stop omniroute && docker rm omniroute
docker run -d --name omniroute --restart unless-stopped \
  --env-file /opt/omniroute/.env \
  -p 20128:20128 \
  -v omniroute-data:/app/data \
  diegosouzapw/omniroute:latest
```

### Lihat log

```bash
docker logs -f omniroute          # Strim masa nyata
docker logs omniroute --tail 50   # 50 baris terakhir
```

### Sandaran pangkalan data secara manual

```bash
# Salin data daripada volum ke hos
docker cp omniroute:/app/data ./backup-$(date +%F)

# Atau mampatkan keseluruhan volum
docker run --rm -v omniroute-data:/data -v $(pwd):/backup \
  alpine tar czf /backup/omniroute-data-$(date +%F).tar.gz /data
```

### Pulihkan daripada sandaran

```bash
docker stop omniroute
docker run --rm -v omniroute-data:/data -v $(pwd):/backup \
  alpine sh -c "rm -rf /data/* && tar xzf /backup/omniroute-data-YYYY-MM-DD.tar.gz -C /"
docker start omniroute
```

---

## 6. Keselamatan Lanjutan

### Hadkan nginx kepada IP Cloudflare

```bash
cat > /etc/nginx/cloudflare-ips.conf << 'CF'
# Julat IPv4 Cloudflare — kemas kini secara berkala
# https://www.cloudflare.com/ips-v4/
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
real_ip_header CF-Connecting-IP;
CF
```

Tambahkan yang berikut pada `nginx.conf` di dalam blok `http {}`:

```nginx
include /etc/nginx/cloudflare-ips.conf;
```

### Pasang fail2ban

```bash
apt install -y fail2ban
systemctl enable fail2ban
systemctl start fail2ban

# Semak status
fail2ban-client status sshd
```

### Sekat akses terus ke port Docker

```bash
# Halang akses luaran terus ke port 20128
iptables -I DOCKER-USER -p tcp --dport 20128 -j DROP
iptables -I DOCKER-USER -i lo -p tcp --dport 20128 -j ACCEPT

# Kekalkan peraturan
apt install -y iptables-persistent
netfilter-persistent save
```

---

## 7. Gunakan pada Cloudflare Workers (Pilihan)

Untuk akses jauh melalui Cloudflare Workers (tanpa mendedahkan VM secara terus):

```bash
# Dalam repositori setempat
cd omnirouteCloud
npm install
npx wrangler login
npx wrangler deploy
```

Lihat juga [TUNNELS_GUIDE.md](./TUNNELS_GUIDE.md) untuk panduan langkah demi langkah Cloudflare Tunnel dalam repositori. Worker kendiri `omnirouteCloud/` berada dalam repositori pendamping yang berasingan.

---

## Ringkasan Port

| Port  | Perkhidmatan | Akses                               |
| ----- | ------------ | ----------------------------------- |
| 22    | SSH          | Awam (dengan fail2ban)              |
| 80    | nginx HTTP   | Ubah hala → HTTPS                   |
| 443   | nginx HTTPS  | Melalui Proksi Cloudflare           |
| 20128 | OmniRoute    | Hos tempatan sahaja (melalui nginx) |

## Pengoptimuman Memori Rendah / VPS Kecil

Untuk pelaksanaan pada tika VPS kecil (RAM 1 GB atau kurang):

- **Nyahdayakan perkhidmatan latar belakang** — tetapkan `OMNIROUTE_DISABLE_BACKGROUND_SERVICES=1` untuk melangkau penjadual, pelayan MCP dan tugas penyelenggaraan berkala. Lihat `docs/reference/ENVIRONMENT.md`.
- **Gunakan mod WAL SQLite** — didayakan secara lalai dan mengurangkan penggunaan memori puncak semasa bacaan serentak.
- **Hadkan timbunan V8** — tetapkan `OMNIROUTE_MEMORY_MB` (contohnya `512`) supaya masa jalan tidak menentukur had yang lebih besar daripada VM. Lihat `docs/reference/ENVIRONMENT.md`.
- **Kemasukan beban berat diskalakan secara automatik mengikut had timbunan** -- setelah `OMNIROUTE_MEMORY_MB` ditetapkan seperti di atas, bajet bait pengingesan (`OMNIROUTE_CHAT_MAX_INFLIGHT_BYTES`) diterbitkan daripada had yang sama, jadi VM dengan memori terhad akan memperoleh bajet permintaan serentak yang lebih kecil tanpa penalaan tambahan; permintaan berlebihan akan menerima respons `503` yang boleh dicuba semula dengan `Retry-After`, dan bukannya bersaing untuk mendapatkan memori. Tetapkan had kiraan permintaan legasi `OMNIROUTE_CHAT_MAX_HEAVY_IN_FLIGHT` hanya jika anda memerlukan had mutlak sebagai tambahan.
- **Elakkan `next build` pada VPS** — bina secara setempat dan laksanakan output kendiri (`.next/standalone/`).
- **Pantau dengan `top` / `free -m`** — OmniRoute biasanya menggunakan RSS sebanyak 200-400 MB ketika melahu pada VM 1 GB.