R524809
108 lines
5.0 KiB
Bash
108 lines
5.0 KiB
Bash
# Local PostgreSQL bootstrap administrator. It creates roles but must never be used by API or Worker.
|
|
POSTGRES_ADMIN_USER=atlas_admin
|
|
POSTGRES_ADMIN_PASSWORD=change-me-local-only
|
|
# Database name and host port exposed by local Docker Compose.
|
|
POSTGRES_DB=atlas
|
|
POSTGRES_PORT=5432
|
|
|
|
# Password for the schema-owning migrator role; only the migration runner may use it.
|
|
ATLAS_MIGRATOR_PASSWORD=change-me-local-only
|
|
# Password for the least-privileged API/Worker login role.
|
|
ATLAS_APP_PASSWORD=change-me-local-only
|
|
# API/Worker application connection. This role has no table ownership and is constrained by RLS.
|
|
DATABASE_URL=postgresql://atlas_app_login:change-me-local-only@localhost:5432/atlas
|
|
# Migration-only connection. Do not put this value in production API or Worker environments.
|
|
MIGRATOR_DATABASE_URL=postgresql://atlas_migrator:change-me-local-only@localhost:5432/atlas
|
|
|
|
# Runtime mode controls production-only safeguards such as Secure cookies.
|
|
NODE_ENV=development
|
|
# Browser origin allowed to send credentialed requests to this API.
|
|
WEB_ORIGIN=http://localhost:8100
|
|
API_PUBLIC_ORIGIN=http://localhost:8200
|
|
# HTTP listener port for the NestJS API.
|
|
API_PORT=8200
|
|
|
|
# HMAC signing secret for short-lived access JWTs; replace with a unique 32+ character secret.
|
|
AUTH_JWT_SECRET=replace-with-a-random-secret-of-at-least-32-characters
|
|
# Separate HMAC secret used to pseudonymize IP/email values in Redis rate-limit keys.
|
|
AUTH_RATE_LIMIT_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
|
|
# AES-GCM 密钥材料，用来加密门店 API Key；只保存在服务端，轮换时变更版本号但保留旧密钥解密能力。
|
|
STORE_SECRET_ENCRYPTION_KEY=replace-with-a-random-secret-of-at-least-32-characters
|
|
# 当前门店密钥使用的加密密钥版本，会随密钥轮换递增。
|
|
STORE_SECRET_ENCRYPTION_KEY_VERSION=v1
|
|
# 对幂等请求内容生成 HMAC 摘要的独立密钥，避免数据库保存原始请求体或 API Key。
|
|
IDEMPOTENCY_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
|
|
# Server-side minimum password length. The browser must not weaken this rule.
|
|
AUTH_PASSWORD_MIN_LENGTH=12
|
|
# Maximum JSON or URL-encoded request size in bytes. Media files must use object-storage direct upload.
|
|
API_BODY_LIMIT_BYTES=1048576
|
|
# Shared fixed-window duration for authentication rate limits, in seconds.
|
|
AUTH_RATE_LIMIT_WINDOW_SECONDS=900
|
|
# Maximum login attempts per IP inside the window.
|
|
AUTH_LOGIN_IP_LIMIT=10
|
|
# Maximum login attempts per normalized email inside the window.
|
|
AUTH_LOGIN_EMAIL_LIMIT=5
|
|
# Maximum registration attempts per IP inside the window.
|
|
AUTH_REGISTER_IP_LIMIT=5
|
|
# Maximum registration attempts per normalized email inside the window.
|
|
AUTH_REGISTER_EMAIL_LIMIT=3
|
|
# Maximum refresh attempts per IP inside the window; refresh tokens have no trusted email before validation.
|
|
AUTH_REFRESH_IP_LIMIT=30
|
|
# 密码修改在同一限流窗口内允许的每 IP 最大次数。
|
|
AUTH_CHANGE_PASSWORD_IP_LIMIT=10
|
|
# 密码修改在同一限流窗口内允许的每已认证用户最大次数。
|
|
AUTH_CHANGE_PASSWORD_USER_LIMIT=5
|
|
|
|
# Comma-separated trusted reverse-proxy IPs/CIDRs. Keep empty for direct local access; never set to true.
|
|
TRUSTED_PROXY_CIDRS=
|
|
# Whether to expose Swagger UI at /api-docs.
|
|
SWAGGER_ENABLED=true
|
|
# Minimum structured-log severity: error, warn, log, or debug.
|
|
LOG_LEVEL=log
|
|
|
|
# Redis endpoint used by BullMQ and shared authentication rate limits.
|
|
REDIS_URL=redis://localhost:6379
|
|
|
|
# S3-compatible object storage. Local development falls back to MinIO root credentials above;
|
|
# production must set dedicated, least-privileged OBJECT_STORAGE_ACCESS_KEY / SECRET_KEY values.
|
|
OBJECT_STORAGE_ENDPOINT=http://localhost:9000
|
|
OBJECT_STORAGE_BUCKET=atlas-assets
|
|
OBJECT_STORAGE_FORCE_PATH_STYLE=true
|
|
# OBJECT_STORAGE_ACCESS_KEY=
|
|
# OBJECT_STORAGE_SECRET_KEY=
|
|
|
|
# Local MinIO root account; it is only for Docker bootstrap, not browser credentials.
|
|
MINIO_ROOT_USER=atlas_minio_local
|
|
# Local MinIO root password; replace outside disposable local development.
|
|
MINIO_ROOT_PASSWORD=change-me-local-only
|
|
# S3-compatible API port for local MinIO.
|
|
MINIO_PORT=9000
|
|
# MinIO administrative console port.
|
|
MINIO_CONSOLE_PORT=9001
|
|
|
|
# Local Vite frontend port.
|
|
WEB_PORT=8100
|
|
# Local WXT browser-extension development port.
|
|
EXTENSION_PORT=8110
|
|
|
|
# DeepSeek API Key
|
|
DEEPSEEK_API_KEY=
|
|
# DeepSeek Model Name
|
|
DEEPSEEK_MODEL_NAME=deepseek-flash
|
|
|
|
# 单张 AI 图片编辑使用 Pcore 的 gpt-image-2 异步图片接口；根地址和 /v1 地址均可，仅 Worker 读取。
|
|
PCORE_BASE_URL=https://pcore.ai/v1
|
|
PCORE_API_KEY=
|
|
|
|
# 首次上架：开发/测试 auto 允许，生产 auto 关闭；完成 VAT 与七牛联调后显式 true。
|
|
OZON_PUBLISH_ENABLED=auto
|
|
# 与素材实际入库环境一致，生产设置 qiniu_kodo。
|
|
OBJECT_STORAGE_PROVIDER=local_minio
|
|
# 七牛绑定的公网 HTTPS 下载域名，与 S3 服务 endpoint 分离。
|
|
OZON_IMAGE_DOWNLOAD_ORIGIN=
|
|
# 图片签名初始有效期 7 天；生产值须通过异步/延迟抓图验收。
|
|
OZON_IMAGE_URL_TTL_SECONDS=604800
|
|
# 可复用对象存储凭据；分离授权时填写专用签名凭据。
|
|
QINIU_ACCESS_KEY=
|
|
QINIU_SECRET_KEY=
|