refactor: align with project_template_go layout + add only_local app-level upload guard

Convention overhaul:
  - deploy/ → example_files/ (template-style; build.sh bundles into release zip)
    - example_files/api_show.service     systemd unit, template style
                                         (User=root, WorkingDirectory=/api_show,
                                          ExecStart=/api_show/api_show, no EnvironmentFile)
    - example_files/install_api_show.sh  install/update/uninstall actions,
                                         backup-rename old binary + config with
                                         _YYYY-MM-DD_HH-MM-SS timestamp
    - example_files/config_example.yaml  yaml schema (secret + upload_token +
                                         data_dir + port + only_local)
    - example_files/nginx.conf           thin reverse proxy; /upload-allowlist
                                         block removed (now app-side)
  - deploy/upgrade.sh dropped (install_api_show.sh `update` action covers it)
  - deploy/install.sh dropped (replaced by example_files/install_api_show.sh)

Config-from-yaml refactor:
  - ac_config/ac_config.go gains FileConfig + LoadConfig(path) + GlobalConfig.
    Reads ./conf/config.yaml relative to WorkingDirectory; missing file is
    NOT fatal (defaults populate; env still overrides).
  - main.go loads yaml at boot, then env vars override file values.
  - Fixed lowercase env var typos: api_show_PORT/SECRET/TOKEN → API_SHOW_*.

App-level LAN guard:
  - new config flag `only_local` (default true): /upload checks
    r.RemoteAddr against IsPrivate() / IsLoopback() / IsLinkLocalUnicast();
    public-IP requesters are 403'd at the app even with valid Bearer.
  - X-Forwarded-For deliberately ignored — only_local trusts the kernel
    peer IP, not headers (forgery-resistant).
  - nginx.conf simplified: no more /upload location block; /upload gating
    fully owned by api_show binary.

build.sh:
  - bundles example_files/{api_show.service,install_api_show.sh,
    config_example.yaml,nginx.conf} into the release zip.

Smoke verified:
  - GOWORK=off go build clean
  - ./build.sh produces api_show_darwin_release_v0.0.3.zip containing
    api_show + install_api_show.sh + api_show.service + conf/config.yaml
    + conf/nginx.conf (7 files, ~12.6MB).

Layout now matches github.com/0xYeah/project_template_go convention.

Author: 0xYeah

ac_config/ac_config.go

@@ -1,19 +1,101 @@
-// Package ac_config exposes module-level identity constants for api_show.
+// Package ac_config exposes module-level identity constants + the runtime
+// FileConfig loader for api_show.
 //
 // Convention shared with certa_base/cb_config, certa_ame/ame_config,
 // certa_cg/cg_config, certa_full/full_config: identity constants below
 // are auto-bumped by ./git_tag.sh; do not edit by hand.
 package ac_config
 
+import (
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v3"
+)
+
 const (
 	ProjectName    = "api_show"
 	ProjectVersion = "v0.0.3"
 
 	// ListenPort is the default HTTP listen port for the api_show portal.
-	// Overridable via api_show_PORT env at boot.
+	// Overridable via API_SHOW_PORT env at boot, or `port` in config.yaml.
 	ListenPort = 12110
 
 	// DefaultDataDir holds uploaded openapi specs at runtime. Overridable via
-	// API_SHOW_DATA env. NOT embedded — content updates require zero rebuild.
+	// API_SHOW_DATA env or `data_dir` in config.yaml. NOT embedded — content
+	// updates require zero rebuild.
 	DefaultDataDir = "./data"
 )
+
+// FileConfig is the on-disk configuration shape (conf/config.yaml).
+//
+// Resolution order at boot (later wins): defaults → file → env vars.
+type FileConfig struct {
+	// Secret is the HMAC cookie key + TOTP key derivation salt. >=16 bytes.
+	Secret string `yaml:"secret" json:"secret"`
+
+	// UploadToken is the Bearer token /upload accepts.
+	UploadToken string `yaml:"upload_token" json:"upload_token"`
+
+	// DataDir is where uploaded openapi specs + totp_blobs/ live.
+	// Empty → DefaultDataDir.
+	DataDir string `yaml:"data_dir" json:"data_dir"`
+
+	// Port is the HTTP listen port. Zero → ListenPort.
+	Port int `yaml:"port" json:"port"`
+
+	// OnlyLocal restricts /upload to clients whose remote address is in a
+	// private / loopback / link-local IP range (LAN-only mode). Public-IP
+	// requesters are 403'd at the app layer regardless of Bearer token —
+	// belt-and-suspenders for portals that should never face the open internet.
+	//
+	// Default: true (LAN-only). Set false to allow public-net uploads
+	// (still gated by Bearer token + nginx in front).
+	OnlyLocal bool `yaml:"only_local" json:"only_local"`
+}
+
+// GlobalConfig is the loaded configuration. Nil before LoadConfig is called;
+// callers should guard or rely on env-only fallback paths.
+var GlobalConfig *FileConfig
+
+// DefaultFileConfig returns the in-code defaults — same shape an empty
+// config.yaml would produce after merging with built-in defaults.
+func DefaultFileConfig() *FileConfig {
+	return &FileConfig{
+		DataDir:   DefaultDataDir,
+		Port:      ListenPort,
+		OnlyLocal: true,
+	}
+}
+
+// LoadConfig parses path as YAML into GlobalConfig. Missing file is NOT an
+// error — caller falls back to env-only behavior with sensible defaults.
+//
+// path == "" → "./conf/config.yaml" (relative to WorkingDirectory).
+func LoadConfig(path string) error {
+	if path == "" {
+		path = "./conf/config.yaml"
+	}
+	cfg := DefaultFileConfig()
+
+	buf, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			GlobalConfig = cfg
+			return nil
+		}
+		return fmt.Errorf("ac_config: read %s: %w", path, err)
+	}
+	if err := yaml.Unmarshal(buf, cfg); err != nil {
+		return fmt.Errorf("ac_config: parse %s: %w", path, err)
+	}
+	// Re-fill zero values from defaults (yaml.Unmarshal won't touch absent fields).
+	if cfg.DataDir == "" {
+		cfg.DataDir = DefaultDataDir
+	}
+	if cfg.Port == 0 {
+		cfg.Port = ListenPort
+	}
+	GlobalConfig = cfg
+	return nil
+}

build.sh

@@ -62,11 +62,11 @@ function toBuild() {
     go build -o "${out_dir}/${product_name}" -trimpath -ldflags "${ld_flag_master}" .
     chmod a+x "${out_dir}/${product_name}"
 
-    # Optional resources — copy when present so the zip is self-installable.
-    [[ -f "./deploy/${product_name}.service" ]] && cp "./deploy/${product_name}.service" "${out_dir}/"
-    [[ -f "./deploy/install.sh" ]]              && cp "./deploy/install.sh"               "${out_dir}/install_${product_name}.sh"
-    [[ -f "./deploy/upgrade.sh" ]]              && cp "./deploy/upgrade.sh"               "${out_dir}/upgrade_${product_name}.sh"
-    [[ -f "./deploy/nginx.conf" ]]              && cp "./deploy/nginx.conf"               "${out_dir}/conf/nginx.conf"
+    # Bundle example_files/ — service + installer + config sample + optional nginx.
+    [[ -f "./example_files/${product_name}.service" ]]    && cp "./example_files/${product_name}.service"    "${out_dir}/"
+    [[ -f "./example_files/install_${product_name}.sh" ]] && cp "./example_files/install_${product_name}.sh" "${out_dir}/install_${product_name}.sh"
+    [[ -f "./example_files/config_example.yaml" ]]        && cp "./example_files/config_example.yaml"        "${out_dir}/conf/config.yaml"
+    [[ -f "./example_files/nginx.conf" ]]                 && cp "./example_files/nginx.conf"                 "${out_dir}/conf/nginx.conf"
 
     package_files
 }

deploy/api_show.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=api_show service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Restart=on-failure
+RestartSec=5s
+ExecStart=/api_show/api_show
+ExecStop=/bin/kill -TERM $MAINPID
+WorkingDirectory=/api_show
+LimitNOFILE=102400
+
+[Install]
+WantedBy=multi-user.target

deploy/install.sh

@@ -0,0 +1,23 @@
+# /api_show/conf/config.yaml
+#
+# Edit this file before first start, then `systemctl restart api_show`.
+# Env vars (API_SHOW_SECRET / TOKEN / DATA / PORT) override yaml fields if set.
+
+# REQUIRED — HMAC cookie key + TOTP key derivation salt. >=16 bytes.
+secret: "REPLACE_ME_at_least_16_chars"
+
+# REQUIRED for /upload — Bearer token clients (cg / ame / future repos) send.
+upload_token: "REPLACE_ME_bearer_token"
+
+# Root dir for uploaded openapi specs + totp_blobs/. Relative to WorkingDirectory.
+# Default: ./data
+data_dir: "./data"
+
+# HTTP listen port. Default: 12110.
+port: 12110
+
+# only_local — restrict /upload to private/loopback/link-local IP ranges
+# (true = LAN-only mode; public-IP clients get 403 regardless of Bearer).
+# Set false ONLY when intentionally exposing /upload over the open internet
+# behind further hardening (nginx + WAF + rate-limit). Default: true.
+only_local: true