superidou
9501751792
三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
>4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)
71 lines
2.5 KiB
Bash
71 lines
2.5 KiB
Bash
# Copy this file to deploy/production.env and replace every CHANGE_ME value.
|
|
# Keep production.env outside version control and restrict it to the deploy user.
|
|
GATEWAY_VERSION=0.10.0
|
|
|
|
POSTGRES_DB=gateway
|
|
POSTGRES_USER=gateway
|
|
POSTGRES_PASSWORD=CHANGE_ME_LONG_RANDOM_POSTGRES_PASSWORD
|
|
REDIS_PASSWORD=CHANGE_ME_LONG_RANDOM_REDIS_PASSWORD
|
|
|
|
# URL-encode special characters in passwords used in URLs.
|
|
DATABASE_URL=postgres://gateway:CHANGE_ME_URL_ENCODED_POSTGRES_PASSWORD@postgres:5432/gateway?sslmode=disable
|
|
REDIS_CRITICAL_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-critical:6379/0
|
|
REDIS_CACHE_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-cache:6379/0
|
|
|
|
# Generate once with: openssl rand -base64 32
|
|
# Never rotate this value without following a KEK rotation procedure.
|
|
CREDENTIAL_MASTER_KEY=CHANGE_ME_BASE64_32_BYTE_KEY
|
|
CREDENTIAL_KEK_VERSION=1
|
|
CREDENTIAL_KEK_KEYRING=
|
|
|
|
# Disabled by default. Create database-backed API keys after bootstrap.
|
|
GATEWAY_BOOTSTRAP_API_KEY_ENABLED=false
|
|
GATEWAY_BOOTSTRAP_API_KEY=
|
|
|
|
UPSTREAM_FALLBACK_ENABLED=false
|
|
UPSTREAM_BASE_URL=https://api.openai.com
|
|
UPSTREAM_API_KEY=
|
|
|
|
ALLOW_PRIVATE_PROVIDER_URLS=false
|
|
ALLOW_PRIVATE_TOOL_URLS=false
|
|
ALLOW_PRIVATE_WEBHOOK_URLS=false
|
|
|
|
GATEWAY_BIND_IP=127.0.0.1
|
|
GATEWAY_PORT=8080
|
|
WEB_BIND_IP=127.0.0.1
|
|
ADMIN_PORT=8081
|
|
PORTAL_PORT=8082
|
|
REDIS_CACHE_MAXMEMORY=256mb
|
|
|
|
# M8 对象存储（MinIO）。MinIO 不暴露主机端口，上传/下载全部经网关代理。
|
|
# 生产建议生成强随机密钥对（S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY），
|
|
# compose 的 minio 服务会用这两个值初始化 MINIO_ROOT_USER/PASSWORD。
|
|
S3_ENDPOINT=http://minio:9000
|
|
S3_ACCESS_KEY_ID=CHANGE_ME_MINIO_ACCESS_KEY
|
|
S3_SECRET_ACCESS_KEY=CHANGE_ME_MINIO_SECRET_KEY
|
|
S3_BUCKET=gateway-files
|
|
S3_REGION=us-east-1
|
|
S3_USE_SSL=false
|
|
S3_MAX_FILE_BYTES=134217728
|
|
|
|
# M8 P2 向量化（本地 Ollama，默认 bge-m3）。生产可整体关闭走纯 FTS：
|
|
# 设 EMBEDDINGS_ENABLED=false 并移除 compose 的 ollama 服务。
|
|
# EMBEDDING_DIM 必须与迁移 000024 的 vector(1024) 列一致。
|
|
EMBEDDINGS_ENABLED=true
|
|
OLLAMA_BASE_URL=http://ollama:11434
|
|
EMBEDDING_MODEL=bge-m3
|
|
EMBEDDING_DIM=1024
|
|
EMBEDDING_BATCH_SIZE=64
|
|
EMBEDDING_TIMEOUT=120s
|
|
|
|
# M8 P3 PostgreSQL 权威队列调度器。
|
|
SCHEDULER_GATEWAY_BASE_URL=http://gateway-api:8080
|
|
SCHEDULER_POLL_INTERVAL=5s
|
|
SCHEDULER_EXECUTION_TIMEOUT=5m
|
|
SCHEDULER_BATCH_SIZE=10
|
|
SCHEDULER_MAX_ATTEMPTS=3
|
|
|
|
# Used only for the one-time bootstrap-admin command; remove after use.
|
|
BOOTSTRAP_ADMIN_USERNAME=admin
|
|
BOOTSTRAP_ADMIN_PASSWORD=CHANGE_ME_AT_LEAST_12_CHARACTERS
|