mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-14 11:37:31 +08:00
982c6c048c
- explicit SecurityConfig authorization for /swagger-ui*, /v3/api-docs*, /webjars/** - public for local/default profile; admin-only (ROLE_ADMIN) by default in production DB profiles - override via MATECLAW_OPENAPI_EXPOSE_UI; add RANDOM_PORT integration tests and docs
55 lines
3.0 KiB
YAML
55 lines
3.0 KiB
YAML
spring:
|
||
datasource:
|
||
# createDatabaseIfNotExist=true — MySQL Connector/J 首次连接时若 DB 不存在则自动 CREATE DATABASE。
|
||
# 本仓库所有建表语句都显式指定 utf8mb4 / utf8mb4_unicode_ci，不依赖 DB 默认字符集，所以即便
|
||
# 自动创建的库用了 server 默认字符集也不会影响数据。要求 DB user 具备 CREATE 权限（默认 root 可）。
|
||
# 如果使用受限账号，请提前手工执行：
|
||
# CREATE DATABASE mateclaw CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||
# characterEncoding takes a Java NIO charset name (UTF-8), not a MySQL
|
||
# server charset name (utf8mb4) — passing utf8mb4 here throws
|
||
# UnsupportedEncodingException at driver init. Java's UTF-8 already
|
||
# encodes the full Unicode range including supplementary-plane chars
|
||
# and emoji, so 4-byte characters travel intact. To make the server
|
||
# treat the connection as utf8mb4, force the connection collation via
|
||
# connectionCollation=utf8mb4_unicode_ci — that is what prevents the
|
||
# `Data truncation: Incorrect string value` errors on emoji/CJK ext.
|
||
url: jdbc:mysql://${DB_HOST:localhost}:${DB_PORT:3306}/${DB_NAME:mateclaw}?createDatabaseIfNotExist=true&useUnicode=true&characterEncoding=UTF-8&connectionCollation=utf8mb4_unicode_ci&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true&connectTimeout=10000&socketTimeout=30000
|
||
driver-class-name: com.mysql.cj.jdbc.Driver
|
||
username: ${DB_USERNAME:root}
|
||
password: ${DB_PASSWORD:mateclaw123}
|
||
|
||
flyway:
|
||
locations:
|
||
- classpath:db/migration/mysql
|
||
|
||
h2:
|
||
console:
|
||
enabled: false
|
||
|
||
# Production (multi-tenant server) hardening: fail closed on source-path
|
||
# validation. With no allowed-source-roots configured, every KB source
|
||
# directory is rejected rather than allowing full-filesystem reads — so a
|
||
# missing allow-list cannot silently re-open arbitrary directory scanning.
|
||
# Set MATE_WIKI_ALLOWED_SOURCE_ROOTS in .env (comma-separated paths):
|
||
# MATE_WIKI_ALLOWED_SOURCE_ROOTS=/data/wiki,/opt/docs
|
||
# The default profile (H2 / desktop / single-tenant) leaves this off.
|
||
# Source watcher master switch (ops gate). Off by default; operators opt in.
|
||
# AND semantics: a KB is auto-scanned only when this global switch AND that
|
||
# KB's own auto-sync toggle are both on. Manual scans are unaffected.
|
||
# MATE_WIKI_WATCHER_ENABLED=true
|
||
# MATE_WIKI_WATCHER_INTERVAL_MS=300000 # scan interval, default 5 min
|
||
mate:
|
||
wiki:
|
||
require-allowed-roots: true
|
||
allowed-source-roots: ${MATE_WIKI_ALLOWED_SOURCE_ROOTS:}
|
||
watcher-enabled: ${MATE_WIKI_WATCHER_ENABLED:false}
|
||
watcher-interval-ms: ${MATE_WIKI_WATCHER_INTERVAL_MS:300000}
|
||
|
||
# Production hardening: lock down the Swagger UI / OpenAPI document so it is not
|
||
# anonymously browsable. Requires a global admin (ROLE_ADMIN); SecurityConfig
|
||
# enforces it. Set MATECLAW_OPENAPI_EXPOSE_UI=true to re-open it for an
|
||
# internal/staging host.
|
||
mateclaw:
|
||
openapi:
|
||
expose-ui: ${MATECLAW_OPENAPI_EXPOSE_UI:false}
|