feat(deploy): add verified image deployments with consistent backups

deploy/compose.image.yml

@@ -0,0 +1,15 @@
+# Copy this file to the instance directory; use a private .env beside it.
+name: ${RAWMARK_PROJECT:?Set RAWMARK_PROJECT}
+services:
+  rawmark:
+    image: ${RAWMARK_IMAGE:?Set a verified registry image digest}
+    ports:
+      - "${RAWMARK_BIND:-127.0.0.1}:${RAWMARK_PORT:?Set RAWMARK_PORT}:8080"
+    volumes:
+      - type: bind
+        source: ${RAWMARK_DATA_DIR:?Set the absolute persistent data directory}
+        target: /data
+        bind:
+          create_host_path: false
+    restart: unless-stopped
+    stop_grace_period: 15s

deploy/nginx/raw-dev.134333.xyz.conf

@@ -0,0 +1,47 @@
+# Keep resource tickets and query strings out of proxy logs.
+map $uri $rawmark_dev_log_path {
+  ~^/api/v1/resources/[^/]+(?<rawmark_dev_suffix>/.*)$ /api/v1/resources/[redacted]$rawmark_dev_suffix;
+  default $uri;
+}
+log_format rawmark_dev '$remote_addr - $remote_user [$time_local] '
+  '"$request_method $rawmark_dev_log_path $server_protocol" $status $body_bytes_sent '
+  '"$http_user_agent"';
+
+server {
+  listen 80;
+  server_name raw-dev.134333.xyz;
+  access_log /var/log/nginx/raw-dev.134333.xyz.log rawmark_dev;
+  error_log /dev/null;
+  return 308 https://$host$request_uri;
+}
+server {
+  listen 443 ssl;
+  http2 on;
+  server_name raw-dev.134333.xyz;
+  include /etc/nginx/snippets/ssl-134333.xyz.conf;
+  include /etc/nginx/snippets/no-spider.conf;
+  access_log /var/log/nginx/raw-dev.134333.xyz.log rawmark_dev;
+  error_log /var/log/nginx/raw-dev.134333.xyz.error.log warn;
+  client_max_body_size 0;
+
+  location / {
+    proxy_pass http://127.0.0.1:21001;
+    proxy_http_version 1.1;
+    proxy_request_buffering off;
+    proxy_buffering off;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_read_timeout 1h;
+    proxy_send_timeout 1h;
+
+    # Error logs cannot redact ticket-bearing request paths.
+    location ^~ /api/v1/resources/ {
+      proxy_pass http://127.0.0.1:21001;
+      error_log /dev/null;
+    }
+  }
+}