mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-13 19:23:42 +08:00
982c6c048c
- explicit SecurityConfig authorization for /swagger-ui*, /v3/api-docs*, /webjars/** - public for local/default profile; admin-only (ROLE_ADMIN) by default in production DB profiles - override via MATECLAW_OPENAPI_EXPOSE_UI; add RANDOM_PORT integration tests and docs
80 lines
3.5 KiB
YAML
80 lines
3.5 KiB
YAML
spring:
|
|
datasource:
|
|
# PostgreSQL data source.
|
|
# Default connection parameters:
|
|
# DB_HOST=localhost, DB_PORT=5432, DB_NAME=mateclaw
|
|
# Override via env vars: DB_HOST, DB_PORT, DB_NAME, DB_USERNAME, DB_PASSWORD
|
|
#
|
|
# JDBC timeouts:
|
|
# connectTimeout=10 — TCP connect timeout (s), avoids OS-level stalls
|
|
# socketTimeout=30 — socket read timeout (s), prevents dead connections hanging forever
|
|
# loginTimeout=10 — database login timeout (s)
|
|
url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:mateclaw}?currentSchema=mateclaw&connectTimeout=10&socketTimeout=30&loginTimeout=10
|
|
driver-class-name: org.postgresql.Driver
|
|
username: ${DB_USERNAME:postgres}
|
|
password: ${DB_PASSWORD:postgres}
|
|
hikari:
|
|
maximum-pool-size: 30
|
|
minimum-idle: 5
|
|
connection-timeout: 30000
|
|
idle-timeout: 300000
|
|
# Recycle connections after 10 min so a leak self-heals quickly rather
|
|
# than surfacing as a ~30 min stall.
|
|
max-lifetime: 600000
|
|
leak-detection-threshold: 30000
|
|
# Fail fast if the first valid connection can't be obtained in time.
|
|
initialization-fail-timeout: 30000
|
|
# Force search_path on every new connection as a belt-and-suspenders
|
|
# guard alongside currentSchema, so connections never land in public.
|
|
connection-init-sql: SET search_path TO mateclaw
|
|
|
|
flyway:
|
|
# PostgreSQL and KingbaseES share the same migration tree
|
|
# (db/migration/kingbase) because they use the same SQL dialect.
|
|
url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:mateclaw}?currentSchema=mateclaw&connectTimeout=10&socketTimeout=30&loginTimeout=10
|
|
user: ${DB_USERNAME:postgres}
|
|
password: ${DB_PASSWORD:postgres}
|
|
locations:
|
|
- classpath:db/migration/kingbase
|
|
# Ensure the target schema exists before migrating (PostgreSQL won't
|
|
# auto-create a non-public schema).
|
|
init-sqls:
|
|
- CREATE SCHEMA IF NOT EXISTS mateclaw
|
|
# Skip checksum validation so an in-place migration edit doesn't block startup.
|
|
validate-on-migrate: false
|
|
|
|
h2:
|
|
console:
|
|
enabled: false
|
|
|
|
# MyBatis Plus — explicit PostgreSQL dialect.
|
|
# The no-arg PaginationInnerInterceptor auto-detects from the JDBC URL, which
|
|
# can fail under a wrapped/proxied DataSource and fall back to the MySQL
|
|
# dialect (LIMIT offset,count). Pin postgre_sql so pagination / ID generation /
|
|
# batch operations always use the correct dialect.
|
|
mybatis-plus:
|
|
global-config:
|
|
db-config:
|
|
db-type: postgre_sql
|
|
|
|
# Production (multi-tenant server) hardening: fail closed on Wiki source-path
|
|
# validation. With no allowed-source-roots configured, every KB source
|
|
# directory is rejected rather than allowing full-filesystem reads — a missing
|
|
# allow-list cannot silently re-open arbitrary directory scanning. Override
|
|
# MATE_WIKI_ALLOWED_SOURCE_ROOTS to permit specific roots. The default profile
|
|
# (H2 / desktop / single-tenant) leaves this off.
|
|
mate:
|
|
wiki:
|
|
require-allowed-roots: true
|
|
allowed-source-roots: ${MATE_WIKI_ALLOWED_SOURCE_ROOTS:}
|
|
watcher-enabled: ${MATE_WIKI_WATCHER_ENABLED:false}
|
|
watcher-interval-ms: ${MATE_WIKI_WATCHER_INTERVAL_MS:300000}
|
|
|
|
# Production hardening: lock down the Swagger UI / OpenAPI document so it is not
|
|
# anonymously browsable. Requires a global admin (ROLE_ADMIN); SecurityConfig
|
|
# enforces it. Set MATECLAW_OPENAPI_EXPOSE_UI=true to re-open it for an
|
|
# internal/staging host.
|
|
mateclaw:
|
|
openapi:
|
|
expose-ui: ${MATECLAW_OPENAPI_EXPOSE_UI:false}
|