*
   * <p>Although all tasks are immediately executed in the thread that submitted the task, this
   * {@code ExecutorService} imposes a small locking overhead on each task submission in order to
   * implement shutdown and termination behavior.
   *
   * <p>Because of the nature of single-thread execution, the methods {@code scheduleAtFixedRate}
   * and {@code scheduleWithFixedDelay} are not supported by this class and will throw an

And there has to be something in charge of **renewing the HTTPS certificates**, it could be the same component or it could be something different.

### Example Tools for HTTPS { #example-tools-for-https }

Some of the tools you could use as a TLS Termination Proxy are:

* Traefik
    * Automatically handles certificates renewals ✨

## 安全性 - HTTPS { #security-https }

在[前一章關於 HTTPS](https.md) 中，我們學到 HTTPS 如何為你的 API 提供加密。

我們也看到，HTTPS 通常由應用伺服器外部的元件提供，即 TLS Termination Proxy。

而且必須有某個東西負責續期 HTTPS 憑證，可能是同一個元件，也可能是不同的東西。

### HTTPS 工具範例 { #example-tools-for-https }

你可以用來作為 TLS Termination Proxy 的工具包括：

- Traefik
    - 自動處理憑證續期 ✨
- Caddy
    - 自動處理憑證續期 ✨
- Nginx
    - 搭配像 Certbot 這類外部元件進行憑證續期
- HAProxy

   *
   * <p>Although all tasks are immediately executed in the thread that submitted the task, this
   * {@code ExecutorService} imposes a small locking overhead on each task submission in order to
   * implement shutdown and termination behavior.
   *
   * <p>Because of the nature of single-thread execution, the methods {@code scheduleAtFixedRate}
   * and {@code scheduleWithFixedDelay} are not supported by this class and will throw an

In most cases you would (and should) have a "termination proxy" handling HTTPS for you on top, this will depend on how you deploy your application, your provider might do this for you, or you might need to set it up yourself.

/// tip

    int writeParameterWordsWireFormat(final byte[] dst, int dstIndex) {
        final int start = dstIndex;

        dst[dstIndex] = (byte) 0x00;
        dstIndex++;
        // name length without counting null termination
        namelen_index = dstIndex;
        dstIndex += 2;
        writeInt4(flags0, dst, dstIndex);
        dstIndex += 4;
        writeInt4(rootDirectoryFid, dst, dstIndex);
        dstIndex += 4;

`fastapi run`을 실행하면 프로덕션 모드로 FastAPI가 시작됩니다.

기본적으로 **auto-reload**는 비활성화되어 있습니다. 또한 사용 가능한 모든 IP 주소를 의미하는 `0.0.0.0`에서 연결을 대기하므로, 해당 컴퓨터와 통신할 수 있는 누구에게나 공개적으로 접근 가능해집니다. 보통 프로덕션에서는 이렇게 실행하며, 예를 들어 컨테이너에서 이런 방식으로 실행합니다.

대부분의 경우 위에 "termination proxy"를 두고 HTTPS를 처리하게(그리고 처리해야) 됩니다. 이는 애플리케이션을 배포하는 방식에 따라 달라지며, 제공자가 이 작업을 대신 처리해줄 수도 있고 직접 설정해야 할 수도 있습니다.

/// tip | 팁

자세한 내용은 [배포 문서](deployment/index.md)에서 확인할 수 있습니다.

これで、次のようなディレクトリ構造になるはずです：

```
.
├── app
│   ├── __init__.py
│   └── main.py
├── Dockerfile
└── requirements.txt
```

#### TLS Termination Proxyの裏側 { #behind-a-tls-termination-proxy }

Nginx や Traefik のような TLS Termination Proxy (ロードバランサ) の後ろでコンテナを動かしている場合は、`--proxy-headers`オプションを追加します。これにより、（FastAPI CLI経由で）Uvicornに対して、そのプロキシから送信されるヘッダを信頼し、アプリケーションがHTTPSの裏で実行されていることなどを示すよう指示します。

```Dockerfile

    license.

    6.4. In the event of termination under Sections 6.1 or 6.2 above,
    all end user licenses that have been validly granted by You or any
    distributor hereunder prior to termination (excluding licenses
    granted to You by any distributor) shall survive termination.

7. LIMITATION OF LIABILITY.

    UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER TORT

`fastapi run` を実行すると、デフォルトで本番モードで起動します。

デフォルトでは、**auto-reload** は無効です。また、IP アドレス `0.0.0.0`（利用可能なすべての IP アドレスを意味します）で待ち受けるため、そのマシンと通信できる任意のクライアントから公開アクセスが可能になります。これは、たとえばコンテナ内など、本番環境で一般的な実行方法です。

多くの場合（そして推奨されるのは）、上位に HTTPS を終端する「termination proxy」を置きます。これはアプリのデプロイ方法に依存し、プロバイダが代行する場合もあれば、自分で設定する必要がある場合もあります。

/// tip

詳しくは、[デプロイのドキュメント](deployment/index.md)を参照してください。