mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-15 03:55:09 +08:00
982c6c048c
- explicit SecurityConfig authorization for /swagger-ui*, /v3/api-docs*, /webjars/** - public for local/default profile; admin-only (ROLE_ADMIN) by default in production DB profiles - override via MATECLAW_OPENAPI_EXPOSE_UI; add RANDOM_PORT integration tests and docs
80 lines
3.8 KiB
YAML
80 lines
3.8 KiB
YAML
spring:
|
||
datasource:
|
||
# 人大金仓 KingbaseES 数据源配置
|
||
# 默认连接参数：
|
||
# DB_HOST=localhost, DB_PORT=54321, DB_NAME=mateclaw
|
||
# KingbaseES 基于 PostgreSQL，兼容 PostgreSQL JDBC 协议
|
||
# 通过环境变量覆盖：DB_HOST, DB_PORT, DB_NAME, DB_USERNAME, DB_PASSWORD
|
||
#
|
||
# JDBC 超时参数说明：
|
||
# connectTimeout=10 — TCP 连接超时（秒），避免 OS 级超时（60-180s）
|
||
# socketTimeout=30 — socket 读取超时（秒），防止僵死连接永久阻塞
|
||
# loginTimeout=10 — 数据库登录超时（秒）
|
||
url: jdbc:kingbase8://${DB_HOST:localhost}:${DB_PORT:54321}/${DB_NAME:mateclaw}?currentSchema=mateclaw&connectTimeout=10&socketTimeout=30&loginTimeout=10
|
||
driver-class-name: com.kingbase8.Driver
|
||
username: ${DB_USERNAME:system}
|
||
password: ${DB_PASSWORD:Admin2026@123}
|
||
hikari:
|
||
maximum-pool-size: 30
|
||
minimum-idle: 5
|
||
connection-timeout: 30000
|
||
idle-timeout: 300000
|
||
# 原 1800000(30min) 与巡检中观察到的 30min 卡住周期吻合 — 若存在连接泄漏，
|
||
# 30min 后 HikariCP 强制回收旧连接才恢复。降至 10min 加快故障自愈速度。
|
||
max-lifetime: 600000
|
||
leak-detection-threshold: 30000
|
||
# 连接池初始化超时：若在此时长内无法获取首个有效连接，快速失败而非无限等待
|
||
initialization-fail-timeout: 30000
|
||
# Kingbase ES：每个新连接初始化时强制设置 search_path，
|
||
# 作为 currentSchema 参数的双重保障，防止连接落入 public schema
|
||
connection-init-sql: SET search_path TO mateclaw
|
||
|
||
flyway:
|
||
# Flyway uses PostgreSQL JDBC driver because KingbaseES is PostgreSQL-compatible
|
||
# on the wire protocol level. The application runtime (MyBatis) still uses the
|
||
# Kingbase8 driver for production queries.
|
||
#
|
||
# JDBC 超时参数：避免 Flyway 连接阶段也因 OS 级 TCP 超时而"卡住"
|
||
url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:54321}/${DB_NAME:mateclaw}?currentSchema=mateclaw&connectTimeout=10&socketTimeout=30&loginTimeout=10
|
||
user: ${DB_USERNAME:system}
|
||
password: ${DB_PASSWORD:Admin2026@123}
|
||
locations:
|
||
- classpath:db/migration/kingbase
|
||
# 迁移前确保目标 schema 存在（Kingbase 不会自动创建非 public schema）
|
||
init-sqls:
|
||
- CREATE SCHEMA IF NOT EXISTS mateclaw
|
||
# 首次迁移或脚本变更后跳过 checksum 校验，避免因脚本转换导致的校验失败卡住
|
||
validate-on-migrate: false
|
||
|
||
h2:
|
||
console:
|
||
enabled: false
|
||
|
||
# MyBatis Plus — Kingbase ES 显式数据库类型
|
||
# PaginationInnerInterceptor 使用无参构造时依赖 JDBC URL 自动检测，
|
||
# 在 DataSource 代理/包装层下可能检测失败回退到 MYSQL 方言，
|
||
# 导致分页 SQL 生成 LIMIT offset,count 而非 LIMIT count OFFSET offset。
|
||
# 显式指定 kingbase_es 确保所有分页/ID生成/批量操作使用正确的方言。
|
||
mybatis-plus:
|
||
global-config:
|
||
db-config:
|
||
db-type: kingbase_es
|
||
|
||
# Production (multi-tenant server) hardening: fail closed on source-path
|
||
# validation. With no allowed-source-roots configured, every KB source
|
||
# directory is rejected rather than allowing full-filesystem reads — so a
|
||
# missing allow-list cannot silently re-open arbitrary directory scanning.
|
||
# Operators set mate.wiki.allowed-source-roots to permit specific roots.
|
||
# The default profile (H2 / desktop / single-tenant) leaves this off.
|
||
mate:
|
||
wiki:
|
||
require-allowed-roots: true
|
||
|
||
# Production hardening: lock down the Swagger UI / OpenAPI document so it is not
|
||
# anonymously browsable. Requires a global admin (ROLE_ADMIN); SecurityConfig
|
||
# enforces it. Set MATECLAW_OPENAPI_EXPOSE_UI=true to re-open it for an
|
||
# internal/staging host.
|
||
mateclaw:
|
||
openapi:
|
||
expose-ui: ${MATECLAW_OPENAPI_EXPOSE_UI:false}
|