R26-1 R26-2 R26-3: 修复 env 注入并补部署校验与 smoke
这个提交包含在：
+157
-107
@@ -1,5 +1,11 @@
|
||||
## hyb-oa 试运行环境变量示例（单机）
|
||||
##
|
||||
## 说明：
|
||||
## - 统一以 deploy/trialrun/.env 作为 trialrun 部署事实源。
|
||||
## - 默认使用 env_file 注入 server / worker / init 容器环境。
|
||||
## - 推荐使用无引号值；旧的带引号写法当前仍兼容，但建议后续逐步改成无引号。
|
||||
## - 普通字符串、布尔值、数字、cron 都可直接写为无引号值。
|
||||
##
|
||||
## 使用方式：
|
||||
## cp deploy/trialrun/.env.example deploy/trialrun/.env
|
||||
## 然后按需修改 deploy/trialrun/.env 中的值（不要提交 .env）
|
||||
@@ -9,128 +15,172 @@
|
||||
## - OA 单独使用 oa.example.com 一类二级域名
|
||||
## - 正式公网环境请保持 APP_ORIGIN=https://oa.example.com
|
||||
## - 正式公网环境请保持 COOKIE_SECURE=true
|
||||
## - 若仅做本机临时演练，再改回 http://127.0.0.1:3000 和 COOKIE_SECURE=false
|
||||
##
|
||||
|
||||
# ===== 基础域名（用于 refresh cookie 的 origin 校验）=====
|
||||
# 单域托管模式下，前端与后端同域访问（建议生产/试运行）。
|
||||
APP_ORIGIN="https://oa.example.com"
|
||||
# ===== 运行模式与基础域名 =====
|
||||
NODE_ENV=production
|
||||
APP_ORIGIN=https://oa.example.com
|
||||
APP_TIMEZONE=Asia/Shanghai
|
||||
HOST=0.0.0.0
|
||||
PORT=3000
|
||||
COOKIE_SECURE=true
|
||||
OPENAPI_DOCS_ENABLED=false
|
||||
SERVE_CLIENT_DIST=true
|
||||
CLIENT_DIST_DIR=../client/dist
|
||||
SIGNED_URL_TTL_SECONDS=600
|
||||
MAX_UPLOAD_SIZE_BYTES=10485760
|
||||
|
||||
# ===== 服务端密钥（必须修改）=====
|
||||
JWT_SECRET="change_me_in_trialrun"
|
||||
# ===== 敏感字段加密（F25）=====
|
||||
# 生成方式示例：openssl rand -base64 32
|
||||
FIELD_ENCRYPTION_KEY=""
|
||||
# ===== 服务端密钥（必须修改） =====
|
||||
JWT_SECRET=change_me_in_trialrun
|
||||
FIELD_ENCRYPTION_KEY=
|
||||
|
||||
# ===== OIDC/SSO（F23，可选）=====
|
||||
# OIDC_ENABLED="true"
|
||||
# OIDC_ISSUER_URL=""
|
||||
# OIDC_CLIENT_ID=""
|
||||
# OIDC_CLIENT_SECRET=""
|
||||
# OIDC_REDIRECT_URI="http://127.0.0.1:3000/api/auth/oidc/callback"
|
||||
# OIDC_SCOPES="openid profile email"
|
||||
# ===== 密码 / 登录安全 =====
|
||||
PASSWORD_RESET_CODE_TTL_SECONDS=600
|
||||
DEV_SHOW_PASSWORD_RESET_CODE=false
|
||||
AUTH_LOGIN_FAIL_WINDOW_SECONDS=900
|
||||
AUTH_LOGIN_FAIL_MAX_ATTEMPTS=5
|
||||
AUTH_LOGIN_LOCK_SECONDS=1800
|
||||
RATE_LIMIT_ENABLED=true
|
||||
RATE_LIMIT_LOGIN_MAX=10
|
||||
RATE_LIMIT_LOGIN_WINDOW=1 minute
|
||||
PUBLIC_SECURITY_HARDENING_ENABLED=true
|
||||
|
||||
# ===== 企业微信入口 / OAuth（R18，可选） =====
|
||||
WECOM_ENABLED="false"
|
||||
WECOM_ENTRY_ENABLED="false"
|
||||
WECOM_CORP_ID=""
|
||||
WECOM_AGENT_ID=""
|
||||
WECOM_AGENT_SECRET=""
|
||||
WECOM_OAUTH_ENABLED="false"
|
||||
WECOM_REDIRECT_URI="https://oa.example.com/api/auth/wecom/callback"
|
||||
# 可填写多个 host，逗号分隔，用于企微回跳和公网 returnTo 白名单
|
||||
WECOM_ALLOWED_RETURN_HOSTS="oa.example.com"
|
||||
IM_NOTIFIER_ENABLED="true"
|
||||
# ===== 可观测性 =====
|
||||
METRICS_ENABLED=true
|
||||
OTEL_TRACES_ENABLED=false
|
||||
|
||||
# ===== 数据库（Compose 内部连接）=====
|
||||
POSTGRES_DB="hyb_oa"
|
||||
POSTGRES_USER="hyboa_user"
|
||||
POSTGRES_PASSWORD="hyboa_password"
|
||||
DATABASE_URL="postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa?schema=public"
|
||||
# ===== OIDC / SSO（可选） =====
|
||||
OIDC_ENABLED=false
|
||||
OIDC_ISSUER_URL=
|
||||
OIDC_CLIENT_ID=
|
||||
OIDC_CLIENT_SECRET=
|
||||
OIDC_REDIRECT_URI=https://oa.example.com/api/auth/oidc/callback
|
||||
OIDC_SCOPES=openid profile email
|
||||
|
||||
# ===== 存储（票据上传目录）=====
|
||||
# 在 deploy/trialrun/docker-compose.yml 中映射到宿主机 deploy/trialrun/data/storage
|
||||
STORAGE_DIR="/data/storage"
|
||||
# 可选：对象存储（MinIO/S3 兼容，F21）
|
||||
# - 默认 local：文件写到 STORAGE_DIR
|
||||
# - 启用 MinIO：STORAGE_DRIVER="s3" 并启用 compose profile：--profile minio
|
||||
STORAGE_DRIVER="local" # local|s3
|
||||
S3_ENDPOINT="http://minio:9000"
|
||||
S3_REGION="us-east-1"
|
||||
S3_BUCKET="hyb-oa"
|
||||
S3_ACCESS_KEY_ID="minioadmin"
|
||||
S3_SECRET_ACCESS_KEY="minioadmin"
|
||||
S3_FORCE_PATH_STYLE="true"
|
||||
# ===== 企业微信入口 / OAuth（可选） =====
|
||||
WECOM_ENABLED=false
|
||||
WECOM_ENTRY_ENABLED=false
|
||||
WECOM_CORP_ID=
|
||||
WECOM_AGENT_ID=
|
||||
WECOM_AGENT_SECRET=
|
||||
WECOM_OAUTH_ENABLED=false
|
||||
WECOM_REDIRECT_URI=https://oa.example.com/api/auth/wecom/callback
|
||||
WECOM_ALLOWED_RETURN_HOSTS=oa.example.com
|
||||
IM_NOTIFIER_ENABLED=true
|
||||
|
||||
MINIO_ROOT_USER="minioadmin"
|
||||
MINIO_ROOT_PASSWORD="minioadmin"
|
||||
# ===== 数据库（Compose 内部连接） =====
|
||||
POSTGRES_DB=hyb_oa
|
||||
POSTGRES_USER=hyboa_user
|
||||
POSTGRES_PASSWORD=hyboa_password
|
||||
DATABASE_URL=postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa?schema=public
|
||||
# SHADOW_DATABASE_URL=postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa_shadow
|
||||
|
||||
# ===== 单域托管 client/dist =====
|
||||
SERVE_CLIENT_DIST="true"
|
||||
CLIENT_DIST_DIR="../client/dist"
|
||||
OPENAPI_DOCS_ENABLED="false"
|
||||
# ===== 存储与上传 =====
|
||||
STORAGE_DIR=/data/storage
|
||||
STORAGE_DRIVER=local
|
||||
S3_ENDPOINT=http://minio:9000
|
||||
S3_REGION=us-east-1
|
||||
S3_BUCKET=hyb-oa
|
||||
S3_ACCESS_KEY_ID=minioadmin
|
||||
S3_SECRET_ACCESS_KEY=minioadmin
|
||||
S3_FORCE_PATH_STYLE=true
|
||||
MINIO_ROOT_USER=minioadmin
|
||||
MINIO_ROOT_PASSWORD=minioadmin
|
||||
|
||||
# ===== 网络与端口 =====
|
||||
HOST="0.0.0.0"
|
||||
PORT="3000"
|
||||
# ===== OCR（off | mock | tencent） =====
|
||||
OCR_PROVIDER=mock
|
||||
OCR_CRON_ENABLED=true
|
||||
OCR_MAX_ATTEMPTS=3
|
||||
OCR_POLL_CRON=*/5 * * * * *
|
||||
OCR_BATCH_SIZE=10
|
||||
OCR_LOCK_TTL_SECONDS=300
|
||||
OCR_TIMEOUT_MS=5000
|
||||
TENCENT_SECRET_ID=
|
||||
TENCENT_SECRET_KEY=
|
||||
TENCENT_OCR_REGION=ap-beijing
|
||||
|
||||
# ===== Cookie 安全（HTTPS 反代时建议 true）=====
|
||||
COOKIE_SECURE="true"
|
||||
# ===== 验真 / 发票 / 节假日 =====
|
||||
INVOICE_VERIFICATION_ENABLED=false
|
||||
LEAVE_HOLIDAY_CALENDAR_ENABLED=false
|
||||
VERIFICATION_PROVIDER=mock
|
||||
VERIFICATION_POLL_CRON=* * * * *
|
||||
VERIFICATION_MAX_ATTEMPTS=3
|
||||
VERIFICATION_RETRY_COOLDOWN_SECONDS=60
|
||||
VERIFICATION_TIMEOUT_MS=5000
|
||||
INVOICE_ARCHIVE_CRON=30 2 * * *
|
||||
INVOICE_ARCHIVE_UNUSED_DAYS=90
|
||||
INVOICE_ARCHIVE_BATCH_SIZE=200
|
||||
|
||||
# ===== Metrics（Prometheus）=====
|
||||
METRICS_ENABLED="true"
|
||||
# ===== 预算 / 费控 =====
|
||||
BUDGET_CONTROL_MODE=warn
|
||||
BUDGET_PRECHECK_ENABLED=false
|
||||
PAYMENT_BATCH_ENABLED=false
|
||||
|
||||
# ===== 安全基线（试运行建议打开）=====
|
||||
RATE_LIMIT_ENABLED="true"
|
||||
RATE_LIMIT_LOGIN_MAX="10"
|
||||
RATE_LIMIT_LOGIN_WINDOW="1 minute"
|
||||
# ===== 周边集成 / ERP =====
|
||||
ERP_SYNC_ENABLED=false
|
||||
ERP_SYNC_PROVIDER=mock
|
||||
ERP_SYNC_ENDPOINT=
|
||||
ERP_SYNC_TIMEOUT_MS=5000
|
||||
ERP_SYNC_AUTH_TOKEN=
|
||||
ERP_JOURNAL_EXPORT_ENDPOINT=
|
||||
ERP_PROCUREMENT_EXPORT_ENDPOINT=
|
||||
ERP_ASSET_EXPORT_ENDPOINT=
|
||||
ERP_MASTER_DATA_ENDPOINT=
|
||||
ERP_PROCUREMENT_TIMEOUT_MS=5000
|
||||
ERP_ASSET_TIMEOUT_MS=5000
|
||||
ERP_MASTER_DATA_TIMEOUT_MS=5000
|
||||
ERP_MASTER_DATA_SYNC_CRON=
|
||||
TRAVEL_SYNC_ENABLED=false
|
||||
INTEGRATION_OUTBOX_CRON=* * * * *
|
||||
INTEGRATION_OUTBOX_BATCH_SIZE=20
|
||||
INTEGRATION_OUTBOX_MAX_ATTEMPTS=5
|
||||
INTEGRATION_OUTBOX_RETRY_SECONDS=120
|
||||
|
||||
# ===== OCR（试运行可先用 mock）=====
|
||||
OCR_PROVIDER="mock" # off|mock|tencent
|
||||
OCR_MAX_ATTEMPTS="3"
|
||||
OCR_POLL_CRON="*/5 * * * * *" # 试运行/演练可用秒级；生产建议分钟级
|
||||
OCR_BATCH_SIZE="10"
|
||||
OCR_LOCK_TTL_SECONDS="300"
|
||||
OCR_TIMEOUT_MS="5000"
|
||||
TENCENT_SECRET_ID=""
|
||||
TENCENT_SECRET_KEY=""
|
||||
TENCENT_OCR_REGION="ap-beijing"
|
||||
# ===== 邮件 =====
|
||||
EMAIL_ENABLED=false
|
||||
EMAIL_FROM=[email protected]
|
||||
EMAIL_BASE_URL=https://oa.example.com
|
||||
SMTP_HOST=
|
||||
SMTP_PORT=587
|
||||
SMTP_SECURE=false
|
||||
SMTP_USER=
|
||||
SMTP_PASS=
|
||||
|
||||
# ===== 委派回收 =====
|
||||
DELEGATION_REVOKE_CRON="0 * * * *"
|
||||
# ===== 委派 / 作业 =====
|
||||
DELEGATION_REVOKE_CRON=0 * * * *
|
||||
JOB_DRIVER=pgboss
|
||||
JOBS_ENABLED=true
|
||||
PG_BOSS_SCHEMA=pgboss
|
||||
|
||||
# ===== 作业系统（pg-boss，可回滚到 cron）=====
|
||||
JOB_DRIVER="pgboss" # cron|pgboss
|
||||
JOBS_ENABLED="true" # false 时整体关闭作业（排障/回滚/或启用 worker 拆分）
|
||||
PG_BOSS_SCHEMA="pgboss" # pg-boss 在 PG 内的 schema
|
||||
# ===== AI（默认关闭） =====
|
||||
AI_ASSIST_ENABLED=false
|
||||
AI_PROVIDER=mock
|
||||
AI_BASE_URL=
|
||||
AI_MODEL=
|
||||
AI_TIMEOUT_MS=10000
|
||||
AI_AUTH_TOKEN=
|
||||
|
||||
# ===== Worker 拆分（可选，F20）=====
|
||||
# 如需启用“API 进程 + Worker 进程”：
|
||||
# 1) 设置 JOBS_ENABLED="false"（server 不跑作业）
|
||||
# 2) 启动 compose 时加：--profile worker（会启动 worker 容器，worker 内强制 JOBS_ENABLED=true）
|
||||
# ===== Trialrun 初始化管理员 =====
|
||||
TRIALRUN_ADMIN_EMAIL=[email protected]
|
||||
TRIALRUN_ADMIN_PHONE=13800000000
|
||||
TRIALRUN_ADMIN_PASSWORD=
|
||||
TRIALRUN_ADMIN_EMPLOYEE_NO=T0000
|
||||
TRIALRUN_ADMIN_NAME=Trialrun Admin
|
||||
TRIALRUN_ADMIN_TITLE=系统管理员
|
||||
TRIALRUN_ADMIN_HIRE_DATE=2020-01-01
|
||||
|
||||
# ===== 试运行引导管理员（E20）=====
|
||||
TRIALRUN_ADMIN_EMAIL="[email protected]"
|
||||
TRIALRUN_ADMIN_PHONE="13800000000"
|
||||
# 留空则首次 seed 自动生成并打印一次性口令
|
||||
TRIALRUN_ADMIN_PASSWORD=""
|
||||
|
||||
# ===== Prisma Migration Diff（本地维护 migration 可选） =====
|
||||
# SHADOW_DATABASE_URL="postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa_shadow"
|
||||
|
||||
# ===== R13-R17 小团队内部管理默认上线建议 =====
|
||||
PORTAL_HOME_ENABLED="true"
|
||||
GLOBAL_SEARCH_ENABLED="true"
|
||||
ANNOUNCEMENTS_ENABLED="true"
|
||||
PRESENCE_BOARD_ENABLED="true"
|
||||
WEEKLY_REPORT_ENABLED="true"
|
||||
EMPLOYEE_LIFECYCLE_ENABLED="true"
|
||||
TODO_BOARD_ENABLED="true"
|
||||
PROJECT_DOMAIN_ENABLED="true"
|
||||
PROJECT_LINKING_ENABLED="true"
|
||||
PROJECT_COMMUNICATION_LOG_ENABLED="true"
|
||||
PROJECT_CLOSURE_CHECKLIST_ENABLED="true"
|
||||
CONFIDENTIAL_DOC_REFS_ENABLED="true"
|
||||
PUBLIC_SECURITY_HARDENING_ENABLED="true"
|
||||
PAYMENT_BATCH_ENABLED="false"
|
||||
CUTOVER_CONSOLE_ENABLED="false"
|
||||
# ===== 功能开关环境闸门（trialrun 推荐） =====
|
||||
PORTAL_HOME_ENABLED=true
|
||||
GLOBAL_SEARCH_ENABLED=true
|
||||
ANNOUNCEMENTS_ENABLED=true
|
||||
PRESENCE_BOARD_ENABLED=true
|
||||
WEEKLY_REPORT_ENABLED=true
|
||||
EMPLOYEE_LIFECYCLE_ENABLED=true
|
||||
TODO_BOARD_ENABLED=true
|
||||
WORKFLOW_DEFINITION_ADMIN_ENABLED=false
|
||||
CUTOVER_CONSOLE_ENABLED=false
|
||||
PROJECT_DOMAIN_ENABLED=true
|
||||
PROJECT_LINKING_ENABLED=true
|
||||
PROJECT_COMMUNICATION_LOG_ENABLED=true
|
||||
PROJECT_CLOSURE_CHECKLIST_ENABLED=true
|
||||
CONFIDENTIAL_DOC_REFS_ENABLED=true
|
||||
|
||||
+50
-2
@@ -13,6 +13,8 @@ ENABLE_MINIO="${ENABLE_MINIO:-0}"
|
||||
SYNC_ENV="${SYNC_ENV:-0}"
|
||||
COMPOSE_FILE="deploy/trialrun/docker-compose.yml"
|
||||
LOCAL_ENV_FILE="deploy/trialrun/.env"
|
||||
ENV_CONTRACT_SCRIPT="deploy/trialrun/validate-env-contract.js"
|
||||
RUNTIME_SMOKE_SCRIPT="server/src/scripts/smoke-trialrun-runtime.js"
|
||||
|
||||
need_cmd() {
|
||||
command -v "$1" >/dev/null 2>&1 || {
|
||||
@@ -23,17 +25,31 @@ need_cmd() {
|
||||
|
||||
need_cmd rsync
|
||||
need_cmd ssh
|
||||
need_cmd node
|
||||
|
||||
if [[ ! -f "${ROOT_DIR}/${COMPOSE_FILE}" ]]; then
|
||||
echo "[ERROR] 缺少 ${COMPOSE_FILE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "${ROOT_DIR}/${ENV_CONTRACT_SCRIPT}" ]]; then
|
||||
echo "[ERROR] 缺少 ${ENV_CONTRACT_SCRIPT}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "${ROOT_DIR}/${RUNTIME_SMOKE_SCRIPT}" ]]; then
|
||||
echo "[ERROR] 缺少 ${RUNTIME_SMOKE_SCRIPT}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "${SYNC_ENV}" == "1" && ! -f "${ROOT_DIR}/${LOCAL_ENV_FILE}" ]]; then
|
||||
echo "[ERROR] SYNC_ENV=1 但本地不存在 ${LOCAL_ENV_FILE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ">>> 0. 校验部署环境契约"
|
||||
node "${ROOT_DIR}/${ENV_CONTRACT_SCRIPT}"
|
||||
|
||||
echo ">>> 1. 创建远端目录"
|
||||
ssh "${DEPLOY_SERVER}" "mkdir -p '${REMOTE_DIR}'"
|
||||
|
||||
@@ -67,7 +83,7 @@ else
|
||||
echo " 如果你确认本地 deploy/trialrun/.env 可直接上服务器，可用：SYNC_ENV=1 bash deploy/trialrun/deploy.sh"
|
||||
fi
|
||||
|
||||
echo ">>> 4. 在服务器执行部署"
|
||||
echo ">>> 4. 在服务器执行部署与 smoke"
|
||||
ssh "${DEPLOY_SERVER}" \
|
||||
"REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' ENABLE_WORKER='${ENABLE_WORKER}' ENABLE_MINIO='${ENABLE_MINIO}' bash -s" <<'REMOTE'
|
||||
set -euo pipefail
|
||||
@@ -96,6 +112,10 @@ if [[ "$ENABLE_WORKER" == "1" ]]; then
|
||||
profile_args+=(--profile worker)
|
||||
fi
|
||||
|
||||
echo ">>> 4.1 校验远端 compose 配置"
|
||||
"${compose_cmd[@]}" "${profile_args[@]}" config >/dev/null
|
||||
|
||||
echo ">>> 4.2 启动基础服务"
|
||||
"${compose_cmd[@]}" up -d db
|
||||
if [[ "$ENABLE_MINIO" == "1" ]]; then
|
||||
"${compose_cmd[@]}" "${profile_args[@]}" up -d minio minio_init
|
||||
@@ -104,11 +124,39 @@ fi
|
||||
if [[ "$ENABLE_WORKER" == "1" ]]; then
|
||||
"${compose_cmd[@]}" "${profile_args[@]}" up -d worker
|
||||
fi
|
||||
"${compose_cmd[@]}" run --rm init
|
||||
|
||||
echo ">>> 4.3 执行 init"
|
||||
"${compose_cmd[@]}" run --rm -T init </dev/null
|
||||
|
||||
echo ">>> 4.4 等待 /ready"
|
||||
ready_ok=0
|
||||
for i in $(seq 1 60); do
|
||||
if curl -fsS http://127.0.0.1:3000/ready >/dev/null; then
|
||||
ready_ok=1
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
if [[ "$ready_ok" != "1" ]]; then
|
||||
echo "[ERROR] /ready 在超时时间内未通过" >&2
|
||||
"${compose_cmd[@]}" logs --tail=200 server || true
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ">>> 4.5 执行 runtime smoke"
|
||||
if ! "${compose_cmd[@]}" exec -T server node src/scripts/smoke-trialrun-runtime.js; then
|
||||
echo "[ERROR] runtime smoke 失败，输出最近 server 日志" >&2
|
||||
"${compose_cmd[@]}" logs --tail=200 server || true
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ">>> 4.6 当前服务状态"
|
||||
"${compose_cmd[@]}" ps
|
||||
REMOTE
|
||||
|
||||
echo ">>> 5. 部署完成"
|
||||
echo " 远端目录: ${REMOTE_DIR}"
|
||||
echo " 环境文件: ${REMOTE_ENV_FILE}"
|
||||
echo " 已自动执行：契约校验 + /ready + runtime smoke"
|
||||
echo " 请确认 Nginx 已把 OA 域名反代到 127.0.0.1:3000"
|
||||
|
||||
+10
-119
@@ -40,6 +40,8 @@ services:
|
||||
profiles: ["minio"]
|
||||
depends_on:
|
||||
- minio
|
||||
env_file:
|
||||
- ./.env
|
||||
entrypoint: ["sh", "-c"]
|
||||
command: |
|
||||
set -e
|
||||
@@ -58,52 +60,10 @@ services:
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- ./.env
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
METRICS_ENABLED: ${METRICS_ENABLED}
|
||||
APP_ORIGIN: ${APP_ORIGIN}
|
||||
JWT_SECRET: ${JWT_SECRET}
|
||||
FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
|
||||
OIDC_ENABLED: ${OIDC_ENABLED}
|
||||
OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
|
||||
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
|
||||
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
|
||||
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
|
||||
OIDC_SCOPES: ${OIDC_SCOPES}
|
||||
DATABASE_URL: ${DATABASE_URL}
|
||||
STORAGE_DIR: ${STORAGE_DIR}
|
||||
STORAGE_DRIVER: ${STORAGE_DRIVER}
|
||||
S3_ENDPOINT: ${S3_ENDPOINT}
|
||||
S3_REGION: ${S3_REGION}
|
||||
S3_BUCKET: ${S3_BUCKET}
|
||||
S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
|
||||
S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
|
||||
S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
|
||||
HOST: ${HOST}
|
||||
PORT: ${PORT}
|
||||
COOKIE_SECURE: ${COOKIE_SECURE}
|
||||
SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
|
||||
CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
|
||||
|
||||
RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED}
|
||||
RATE_LIMIT_LOGIN_MAX: ${RATE_LIMIT_LOGIN_MAX}
|
||||
RATE_LIMIT_LOGIN_WINDOW: ${RATE_LIMIT_LOGIN_WINDOW}
|
||||
|
||||
OCR_PROVIDER: ${OCR_PROVIDER}
|
||||
OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
|
||||
OCR_POLL_CRON: ${OCR_POLL_CRON}
|
||||
OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
|
||||
OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
|
||||
OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
|
||||
TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
|
||||
TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
|
||||
TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
|
||||
|
||||
DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
|
||||
|
||||
JOB_DRIVER: ${JOB_DRIVER}
|
||||
JOBS_ENABLED: ${JOBS_ENABLED}
|
||||
PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
|
||||
ports:
|
||||
- "3000:3000"
|
||||
volumes:
|
||||
@@ -119,46 +79,13 @@ services:
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- ./.env
|
||||
command: ["npm", "run", "worker"]
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
METRICS_ENABLED: ${METRICS_ENABLED}
|
||||
APP_ORIGIN: ${APP_ORIGIN}
|
||||
JWT_SECRET: ${JWT_SECRET}
|
||||
FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
|
||||
OIDC_ENABLED: ${OIDC_ENABLED}
|
||||
OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
|
||||
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
|
||||
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
|
||||
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
|
||||
OIDC_SCOPES: ${OIDC_SCOPES}
|
||||
DATABASE_URL: ${DATABASE_URL}
|
||||
STORAGE_DIR: ${STORAGE_DIR}
|
||||
STORAGE_DRIVER: ${STORAGE_DRIVER}
|
||||
S3_ENDPOINT: ${S3_ENDPOINT}
|
||||
S3_REGION: ${S3_REGION}
|
||||
S3_BUCKET: ${S3_BUCKET}
|
||||
S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
|
||||
S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
|
||||
S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
|
||||
SERVE_CLIENT_DIST: "false"
|
||||
CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
|
||||
|
||||
OCR_PROVIDER: ${OCR_PROVIDER}
|
||||
OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
|
||||
OCR_POLL_CRON: ${OCR_POLL_CRON}
|
||||
OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
|
||||
OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
|
||||
OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
|
||||
TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
|
||||
TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
|
||||
TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
|
||||
|
||||
DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
|
||||
|
||||
JOB_DRIVER: ${JOB_DRIVER}
|
||||
JOBS_ENABLED: "true"
|
||||
PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
|
||||
volumes:
|
||||
- ./data/storage:${STORAGE_DIR}
|
||||
|
||||
@@ -170,52 +97,16 @@ services:
|
||||
depends_on:
|
||||
db:
|
||||
condition: service_healthy
|
||||
env_file:
|
||||
- ./.env
|
||||
environment:
|
||||
NODE_ENV: production
|
||||
METRICS_ENABLED: ${METRICS_ENABLED}
|
||||
APP_ORIGIN: ${APP_ORIGIN}
|
||||
JWT_SECRET: ${JWT_SECRET}
|
||||
FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
|
||||
OIDC_ENABLED: ${OIDC_ENABLED}
|
||||
OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
|
||||
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
|
||||
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
|
||||
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
|
||||
OIDC_SCOPES: ${OIDC_SCOPES}
|
||||
DATABASE_URL: ${DATABASE_URL}
|
||||
STORAGE_DIR: ${STORAGE_DIR}
|
||||
STORAGE_DRIVER: ${STORAGE_DRIVER}
|
||||
S3_ENDPOINT: ${S3_ENDPOINT}
|
||||
S3_REGION: ${S3_REGION}
|
||||
S3_BUCKET: ${S3_BUCKET}
|
||||
S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
|
||||
S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
|
||||
S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
|
||||
SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
|
||||
CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
|
||||
OCR_PROVIDER: ${OCR_PROVIDER}
|
||||
OCR_POLL_CRON: ${OCR_POLL_CRON}
|
||||
OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
|
||||
OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
|
||||
OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
|
||||
OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
|
||||
TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
|
||||
TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
|
||||
TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
|
||||
DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
|
||||
JOB_DRIVER: ${JOB_DRIVER}
|
||||
JOBS_ENABLED: ${JOBS_ENABLED}
|
||||
PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
|
||||
|
||||
TRIALRUN_ADMIN_EMAIL: ${TRIALRUN_ADMIN_EMAIL}
|
||||
TRIALRUN_ADMIN_PHONE: ${TRIALRUN_ADMIN_PHONE}
|
||||
TRIALRUN_ADMIN_PASSWORD: ${TRIALRUN_ADMIN_PASSWORD}
|
||||
volumes:
|
||||
- ./data/storage:${STORAGE_DIR}
|
||||
entrypoint: ["sh", "-c"]
|
||||
command: >
|
||||
"cd /app/server
|
||||
cd /app/server
|
||||
&& npm run prisma:migrate:deploy
|
||||
&& npm run seed:config
|
||||
&& npm run seed:trialrun"
|
||||
&& npm run seed:trialrun
|
||||
restart: "no"
|
||||
|
||||
+154
@@ -0,0 +1,154 @@
|
||||
#!/usr/bin/env node
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
|
||||
const rootDir = path.resolve(__dirname, '..', '..');
|
||||
const configPath = path.join(rootDir, 'server/src/config.js');
|
||||
const envExamplePath = path.join(rootDir, 'deploy/trialrun/.env.example');
|
||||
const composePath = path.join(rootDir, 'deploy/trialrun/docker-compose.yml');
|
||||
|
||||
const requiredServices = ['server', 'worker', 'init'];
|
||||
const allowedOverrides = {
|
||||
server: ['NODE_ENV'],
|
||||
worker: ['NODE_ENV', 'SERVE_CLIENT_DIST', 'JOBS_ENABLED'],
|
||||
init: ['NODE_ENV'],
|
||||
};
|
||||
|
||||
function readFile(filePath) {
|
||||
return fs.readFileSync(filePath, 'utf8');
|
||||
}
|
||||
|
||||
function extractConfigEnvKeys(content) {
|
||||
const keys = new Set();
|
||||
for (const match of content.matchAll(/process\.env\.([A-Z0-9_]+)/g)) {
|
||||
keys.add(match[1]);
|
||||
}
|
||||
for (const match of content.matchAll(/requiredEnv\("([A-Z0-9_]+)"\)/g)) {
|
||||
keys.add(match[1]);
|
||||
}
|
||||
return [...keys].sort();
|
||||
}
|
||||
|
||||
function extractEnvExampleKeys(content) {
|
||||
const keys = new Set();
|
||||
for (const line of content.split(/\r?\n/)) {
|
||||
const match = line.match(/^\s*#?\s*([A-Z0-9_]+)\s*=/);
|
||||
if (match) {
|
||||
keys.add(match[1]);
|
||||
}
|
||||
}
|
||||
return keys;
|
||||
}
|
||||
|
||||
function extractServiceBlock(composeContent, serviceName) {
|
||||
const lines = composeContent.split(/\r?\n/);
|
||||
let capture = false;
|
||||
const block = [];
|
||||
|
||||
for (const line of lines) {
|
||||
const serviceMatch = line.match(/^ ([A-Za-z0-9_]+):\s*$/);
|
||||
if (serviceMatch) {
|
||||
if (capture) {
|
||||
break;
|
||||
}
|
||||
capture = serviceMatch[1] === serviceName;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (capture) {
|
||||
block.push(line);
|
||||
}
|
||||
}
|
||||
|
||||
return block.length ? block.join('\n') : null;
|
||||
}
|
||||
|
||||
function extractSection(serviceBlock, sectionName) {
|
||||
const lines = serviceBlock.split(/\r?\n/);
|
||||
const sectionLines = [];
|
||||
let capture = false;
|
||||
|
||||
for (const line of lines) {
|
||||
const sectionMatch = line.match(/^\s{4}([A-Za-z0-9_]+):\s*$/);
|
||||
if (sectionMatch) {
|
||||
if (capture) {
|
||||
break;
|
||||
}
|
||||
capture = sectionMatch[1] === sectionName;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (capture) {
|
||||
sectionLines.push(line);
|
||||
}
|
||||
}
|
||||
|
||||
return sectionLines;
|
||||
}
|
||||
|
||||
function extractEnvFileEntries(serviceBlock) {
|
||||
return extractSection(serviceBlock, 'env_file')
|
||||
.map((line) => line.match(/^\s{6}-\s*(.+?)\s*$/))
|
||||
.filter(Boolean)
|
||||
.map((item) => item[1]);
|
||||
}
|
||||
|
||||
function extractEnvironmentKeys(serviceBlock) {
|
||||
return extractSection(serviceBlock, 'environment')
|
||||
.map((line) => line.match(/^\s{6}([A-Z0-9_]+):/))
|
||||
.filter(Boolean)
|
||||
.map((item) => item[1]);
|
||||
}
|
||||
|
||||
function fail(message, errors) {
|
||||
console.error(`[R26][FAIL] ${message}`);
|
||||
for (const error of errors) {
|
||||
console.error(`- ${error}`);
|
||||
}
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const configContent = readFile(configPath);
|
||||
const envExampleContent = readFile(envExamplePath);
|
||||
const composeContent = readFile(composePath);
|
||||
|
||||
const configKeys = extractConfigEnvKeys(configContent);
|
||||
const envExampleKeys = extractEnvExampleKeys(envExampleContent);
|
||||
const errors = [];
|
||||
|
||||
for (const key of configKeys) {
|
||||
if (!envExampleKeys.has(key)) {
|
||||
errors.push(`.env.example 缺少 ${key}`);
|
||||
}
|
||||
}
|
||||
|
||||
for (const serviceName of requiredServices) {
|
||||
const block = extractServiceBlock(composeContent, serviceName);
|
||||
if (!block) {
|
||||
errors.push(`docker-compose.yml 缺少服务 ${serviceName}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
const envFiles = extractEnvFileEntries(block);
|
||||
if (!envFiles.includes('./.env')) {
|
||||
errors.push(`服务 ${serviceName} 未通过 env_file 引用 ./.env`);
|
||||
}
|
||||
|
||||
const environmentKeys = extractEnvironmentKeys(block);
|
||||
const illegalOverrides = environmentKeys.filter(
|
||||
(key) => !(allowedOverrides[serviceName] ?? []).includes(key),
|
||||
);
|
||||
|
||||
if (illegalOverrides.length) {
|
||||
errors.push(`服务 ${serviceName} 存在未授权 override: ${illegalOverrides.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (errors.length) {
|
||||
fail('部署环境契约校验失败', errors);
|
||||
}
|
||||
|
||||
console.log('[R26][PASS] 部署环境契约校验通过');
|
||||
console.log(`- config.js env 键数: ${configKeys.length}`);
|
||||
console.log(`- .env.example env 键数: ${envExampleKeys.size}`);
|
||||
console.log(`- 已检查服务: ${requiredServices.join(', ')}`);
|
||||
在新工单中引用
屏蔽一个用户