b7a7430cc3
All checks were successful
构建并部署到测试环境（无 SSH） / build-and-deploy (push) Successful in 12m8s
- 审计注册表为可由系统任务、定时任务发起的动作声明落库策略（always/on_success/outcome/log_only/none），未声明按 log_only - 人工、开放接口、个人客户、外部系统发起的动作始终写审计表 - log_only 写所在服务 app.log（logger=audit），不含快照 - 对接日志不再补写 integration.attempt_started，无上游审计时 audit_event_id 为空 - 新增 audit.persist_overrides 按动作覆盖策略 - 审计覆盖扫描要求机器动作必须声明策略 - 新增 OpenSpec 提案 refactor-audit-log-persistence 与技术方案文档 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
180 lines
5.4 KiB
YAML
180 lines
5.4 KiB
YAML
# 默认配置文件（嵌入二进制）
|
||
# 敏感配置和必填配置为空，必须通过环境变量设置
|
||
# 环境变量格式：JUNHONG_{SECTION}_{KEY}
|
||
|
||
server:
|
||
address: ":3000"
|
||
read_timeout: "30s"
|
||
write_timeout: "30s"
|
||
shutdown_timeout: "30s"
|
||
prefork: false
|
||
|
||
# 数据库配置（必填项需通过环境变量设置）
|
||
database:
|
||
host: "" # 必填：JUNHONG_DATABASE_HOST
|
||
port: 5432
|
||
user: "" # 必填：JUNHONG_DATABASE_USER
|
||
password: "" # 必填：JUNHONG_DATABASE_PASSWORD（敏感）
|
||
dbname: "" # 必填：JUNHONG_DATABASE_DBNAME
|
||
sslmode: "disable"
|
||
max_open_conns: 25
|
||
max_idle_conns: 10
|
||
conn_max_lifetime: "5m"
|
||
|
||
# Redis 配置（必填项需通过环境变量设置）
|
||
redis:
|
||
address: "" # 必填：JUNHONG_REDIS_ADDRESS
|
||
port: 6379
|
||
password: "" # 可选：JUNHONG_REDIS_PASSWORD（敏感）
|
||
db: 0
|
||
pool_size: 10
|
||
min_idle_conns: 5
|
||
dial_timeout: "5s"
|
||
read_timeout: "3s"
|
||
write_timeout: "3s"
|
||
|
||
# 对象存储配置
|
||
storage:
|
||
provider: "s3"
|
||
temp_dir: "/tmp/junhong-storage"
|
||
s3:
|
||
endpoint: "" # 可选：JUNHONG_STORAGE_S3_ENDPOINT
|
||
region: "" # 可选：JUNHONG_STORAGE_S3_REGION
|
||
bucket: "" # 可选：JUNHONG_STORAGE_S3_BUCKET
|
||
access_key_id: "" # 可选：JUNHONG_STORAGE_S3_ACCESS_KEY_ID（敏感）
|
||
secret_access_key: "" # 可选：JUNHONG_STORAGE_S3_SECRET_ACCESS_KEY（敏感）
|
||
use_ssl: false
|
||
path_style: true
|
||
presign:
|
||
upload_expires: "15m"
|
||
download_expires: "24h"
|
||
|
||
# 日志配置
|
||
logging:
|
||
level: "info"
|
||
development: false
|
||
app_log:
|
||
filename: "/app/logs/app.log"
|
||
max_size: 100
|
||
max_backups: 3
|
||
max_age: 7
|
||
compress: true
|
||
access_log:
|
||
filename: "/app/logs/access.log"
|
||
max_size: 100
|
||
max_backups: 3
|
||
max_age: 7
|
||
compress: true
|
||
retention_log:
|
||
filename: "logs/audit-retention.log"
|
||
max_size: 100
|
||
max_backups: 3
|
||
max_age: 7
|
||
compress: true
|
||
|
||
# 任务队列配置
|
||
queue:
|
||
concurrency: 10
|
||
queues:
|
||
critical: 6
|
||
default: 3
|
||
low: 1
|
||
retry_max: 5
|
||
timeout: "10m"
|
||
|
||
# JWT 配置（必填项需通过环境变量设置）
|
||
jwt:
|
||
secret_key: "" # 必填：JUNHONG_JWT_SECRET_KEY（敏感）
|
||
token_duration: "24h"
|
||
access_token_ttl: "24h"
|
||
refresh_token_ttl: "168h"
|
||
|
||
# 中间件配置
|
||
middleware:
|
||
enable_rate_limiter: false
|
||
rate_limiter:
|
||
max: 100
|
||
expiration: "1m"
|
||
storage: "memory"
|
||
cors:
|
||
enabled: true
|
||
allow_origins: "*"
|
||
allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS"
|
||
allow_headers: "Origin,Content-Type,Accept,Authorization,X-Requested-With,X-Request-ID"
|
||
expose_headers: "Content-Length,X-Request-ID"
|
||
allow_credentials: false
|
||
max_age: 86400
|
||
|
||
# 客户端配置
|
||
client:
|
||
require_phone_binding: true # 是否要求个人客户绑定手机号
|
||
|
||
# 短信服务配置
|
||
sms:
|
||
gateway_url: "" # 可选：JUNHONG_SMS_GATEWAY_URL
|
||
username: "" # 可选：JUNHONG_SMS_USERNAME
|
||
password: "" # 可选：JUNHONG_SMS_PASSWORD（敏感）
|
||
signature: "" # 可选：JUNHONG_SMS_SIGNATURE
|
||
timeout: "10s"
|
||
|
||
# 默认超级管理员配置（可选）
|
||
default_admin:
|
||
username: ""
|
||
password: ""
|
||
phone: ""
|
||
|
||
# Gateway 服务配置
|
||
gateway:
|
||
base_url: "https://lplan.whjhft.com/openapi"
|
||
app_id: "60bgt1X8i7AvXqkd"
|
||
app_secret: "BZeQttaZQt0i73moF"
|
||
timeout: 60
|
||
|
||
# 轮询配置
|
||
polling:
|
||
verbose_log: false # 是否开启详细日志（环境变量：JUNHONG_POLLING_VERBOSE_LOG）
|
||
# 按运营商账户调度（调度模式在受控系统配置 polling.scheduler.mode 切换）
|
||
carrier:
|
||
nsqd_address: "" # nsqd TCP 地址，如 nsqd:4150（环境变量：JUNHONG_POLLING_CARRIER_NSQD_ADDRESS）
|
||
nsqlookupd_addresses: "" # nsqlookupd HTTP 地址，逗号分隔（环境变量：JUNHONG_POLLING_CARRIER_NSQLOOKUPD_ADDRESSES）
|
||
msg_timeout: 90s # NSQ 消息超时，须大于续期间隔
|
||
max_attempts: 3 # NSQ 允许投递次数（含首次）
|
||
lease: 300s # 处理中标记 TTL，须大于 msg_timeout × max_attempts
|
||
renew_interval: 30s # 租约续期间隔
|
||
dispatch_interval: 1s # 分发间隔
|
||
shutdown_grace: 30s # 优雅退出宽限期
|
||
default_inflight_limit: 20 # 未配置账户的执行上限（跨实例）
|
||
default_card_max_in_flight: 20 # 未配置账户的每进程 max_in_flight
|
||
subscriber_processes: 1 # 订阅卡任务的 Worker 进程数（校验执行上限用）
|
||
|
||
# 轮询自动触发配置
|
||
polling_auto_trigger:
|
||
enable_auto_trigger: true
|
||
auto_trigger_system_user_id: 1 # 暂用 SuperAdmin，生产环境建议创建专用平台账号并更新此值
|
||
|
||
# Worker 运行配置
|
||
worker:
|
||
role: "all"
|
||
instance_name: ""
|
||
polling_total_max_concurrency: 100
|
||
# 日留存只读演练验收通过前必须保持关闭
|
||
audit_retention_cleanup_enabled: false
|
||
# 审计归档、Integration 归档与日留存默认关闭，低峰期按单日推进
|
||
audit_archive_tasks_enabled: false
|
||
|
||
# 统一审计写入配置
|
||
audit:
|
||
# 按动作覆盖系统任务、定时任务的落库策略，例如 "package_usage.expire=log_only"；为空不覆盖
|
||
persist_overrides: ""
|
||
|
||
# 审批新旧入口切换配置
|
||
approval:
|
||
legacy_refund_manual_enabled: true
|
||
legacy_offline_recharge_pay_enabled: true
|
||
|
||
|
||
# 企业微信 Adapter 配置
|
||
wecom:
|
||
base_url: "https://qyapi.weixin.qq.com"
|
||
timeout: "10s"
|