This deployment runs an amd64 image on the ZSpace NAS. Build the image on the development machine, then transfer and load it on the NAS; the NAS does not need Docker Hub access. Deployment files and Markdown data remain separate:

Deployment: 个人空间/docker/plainleaf
Markdown space: 个人空间/笔记管理/Plainleaf

The server listens on NAS port 31230, runs as the NAS account's UID/GID, and has SilverBullet shell execution disabled. Authentication is supplied through a deployment-local .env file that must not be committed.

The intended .env keys are:

PLAINLEAF_IMAGE_TAG=<git-short-sha>
PLAINLEAF_UID=1001
PLAINLEAF_GID=1001
PLAINLEAF_PORT=31230
PLAINLEAF_SPACE_PATH=/tmp/zfsv3/sata11/13616066635/data/笔记管理/Plainleaf
PLAINLEAF_USER=your-user:your-password

Do not commit the real .env file. Do not expose the service publicly until a separate HTTPS reverse-proxy configuration has been verified.