23e5a600ad
- .env.example: 3 处真 key 替换为 <REPLACE_ME_*> 占位
- L104 DIFY_API_KEY (原 app-tIfFhFwj3xnbRurK1oxxBXnA, 注释内也含)
- L117 OPENAI_API_KEY (原 sk-proj-srKxyb... 完整 164 字符)
- L135 OPENAI_API_KEY (原 sk-eIOujD5rUugIRIPecFi3I2rFr6...)
- L142 DIFY_API_KEY (原 app-aHnBfMeOQp7A9dQneIFPdPaZ)
生产真值由环境变量注入(backend/.env / docker/.env / K8s Secret);
- .gitignore: 加严真 .env 排除
- backend/.env / backend/.env.local / backend/.env.production / *.local
- docker/.env / docker/.env.local / docker/.env.prod / *.local
- backend/services/*/.env
防 0b 阶段(运维轮换)完成前有人误提交真值文件;
- 自检: grep -E 'sk-proj|sk-eIOu|app-[A-Za-z0-9]{20,}' backend/.env.example = 0 真 key
- 后续: 0b 阶段(运维真轮换)完成后, 跑 .superpowers/sdd/batch0-filter-repo-commands.md
列出的 git filter-repo 命令清历史(用户 review 后执行)。
Co-Authored-By: Claude <noreply@anthropic.com>
154 lines
6.5 KiB
Plaintext
154 lines
6.5 KiB
Plaintext
# ==================== H5 落地页 Base URL ====================
|
||
# 分享服务生成的落地页链接前缀 (landingBase + asset_id + from=sharer + s=system_type)
|
||
# - 本地开发: http://localhost:5173 (Vite H5 默认端口,可在 .env 覆盖)
|
||
# - 生产环境: 由 deploy/envs/asset.env 注入实际域名
|
||
# 注意: 与 frontend/.env.production 的 VITE_LANDING_BASE_URL 保持一致
|
||
LANDING_BASE_URL=http://localhost:5173
|
||
|
||
# ==================== Server Configuration ====================
|
||
# Gin运行模式: debug, release, test
|
||
GIN_MODE=release
|
||
# API网关端口
|
||
SERVER_PORT=8080
|
||
|
||
# ==================== JWT Configuration ====================
|
||
# JWT 密钥(MustInit 必填,≥32 字节随机;启动期 MustInit 校验)
|
||
# 示例: 任意 32+ 字节随机串(可用 `openssl rand -base64 48` 生成)
|
||
# 占位示例(本地开发/CI 用,MUST replace in prod): 随机 base64 字符串(48 字节 = 64 base64 字符)
|
||
JWT_SECRET=ZGV2X2p3dF9zZWNyZXRfa2V5X3BsYWNlaG9sZGVyX2F1dGhfbmVlZHNfdG9fYmVfMzJfYnl0ZXNfbG9uZw==
|
||
|
||
# ==================== Dubbo Service URLs ====================
|
||
# 各微服务的Dubbo连接地址（直连模式）
|
||
# 默认端口需与 backend/services/<svc>/main.go 顶部 flag.Int("port", ...) 一致
|
||
DUBBO_USER_SERVICE_URL=tri://127.0.0.1:20000
|
||
DUBBO_SOCIAL_SERVICE_URL=tri://127.0.0.1:20002
|
||
DUBBO_ASSET_SERVICE_URL=tri://127.0.0.1:20003
|
||
DUBBO_GALLERY_SERVICE_URL=tri://127.0.0.1:20001
|
||
DUBBO_ACTIVITY_SERVICE_URL=tri://127.0.0.1:20004
|
||
DUBBO_TASK_SERVICE_URL=tri://127.0.0.1:20006
|
||
DUBBO_AI_CHAT_SERVICE_URL=tri://127.0.0.1:20008
|
||
DUBBO_STATISTIC_SERVICE_URL=tri://127.0.0.1:20009
|
||
DUBBO_NOTIFICATION_SERVICE_URL=tri://127.0.0.1:20010
|
||
DUBBO_MODERATION_SERVICE_URL=tri://127.0.0.1:20011
|
||
|
||
# ==================== Database Configuration ====================
|
||
# PostgreSQL数据库配置
|
||
DB_HOST=localhost
|
||
DB_PORT=5432
|
||
DB_USER=postgres
|
||
DB_PASSWORD=postgres
|
||
DB_NAME=topfans
|
||
|
||
# ==================== Redis Configuration ====================
|
||
REDIS_HOST=127.0.0.1
|
||
REDIS_PORT=6379
|
||
REDIS_PASSWORD=
|
||
REDIS_DB=0
|
||
|
||
# ==================== OSS Configuration ====================
|
||
# 阿里云OSS配置
|
||
OSS_REGION=cn-shanghai
|
||
OSS_BUCKET_NAME=your-bucket-name
|
||
OSS_STS_ROLE_ARN=acs:ram::1234567890123456:role/your-oss-role-name
|
||
OSS_ACCESS_KEY_ID=your-access-key-id
|
||
OSS_ACCESS_KEY_SECRET=your-access-key-secret
|
||
OSS_AVATAR_DIR=avatar/
|
||
OSS_ASSET_DIR=asset/
|
||
OSS_TOKEN_EXPIRE_TIME=3600
|
||
|
||
# ==================== Service Ports ====================
|
||
# 各服务端口（用于flag参数）
|
||
# User Service: 20000
|
||
# Social Service: 20002
|
||
# Asset Service: 20003
|
||
# Gallery Service: 20001
|
||
# Activity Service: 20004
|
||
# Task Service: 20006
|
||
# AI Chat Service: 20008
|
||
# Statistic Service: 20009
|
||
# Notification Service: 20010
|
||
# Moderation Service: 20011
|
||
|
||
# ==================== Logging ====================
|
||
# 环境: development, production
|
||
ENV=development
|
||
# 日志级别: debug, info, warn, error
|
||
LOG_LEVEL=info
|
||
# ==================== MiniMax API Configuration ====================
|
||
MINIMAX_API_KEY=
|
||
MINIMAX_API_URL=https://api.minimaxi.com/v1/image_generation
|
||
|
||
# ==================== Segment (镭射卡抠图) ====================
|
||
# auto=自部署HTTP(若有)→imageseg→IVPD；imageseg=VIAPI SegmentHDBody；ivpd=旧版 IVPD SegmentImage
|
||
SEGMENT_PROVIDER=imageseg
|
||
# 自部署 rembg：http://127.0.0.1:7000/api/remove
|
||
SEGMENT_INFERENCE_URL=
|
||
|
||
# ==================== WebSocket ====================
|
||
# AI Chat WebSocket 路径（用于 Nginx 反向代理）
|
||
# 完整连接 URL = ws://<host>:<port><WS_AI_CHAT_PATH>?token=Bearer_xxx
|
||
# 需与 frontend/.env.{development,production} 的 VITE_WS_AI_CHAT_PATH 保持一致
|
||
# Nginx 反代示例：
|
||
# location /ai-chat {
|
||
# proxy_pass http://gateway:8080;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Upgrade $http_upgrade;
|
||
# proxy_set_header Connection "upgrade";
|
||
# }
|
||
# WS_AI_CHAT_PATH=/ai-chat
|
||
|
||
# ==================== Dify AI Workflow ====================
|
||
# Dify API 地址（自部署或云服务）
|
||
DIFY_API_BASE=http://localhost/v1
|
||
# Dify App API Key（laser_card_variants_v1 工作流）
|
||
# DIFY_API_KEY=<REPLACE_ME_DIFY_KEY>(原 key 已从示例中移除, 真值由环境变量注入)
|
||
# Dify 工作流名称（relay-dify 模式时使用的 Dify app，用于 prompt 增强）
|
||
DIFY_WORKFLOW=laser_prompt_enhancer_v2
|
||
# ==================== 镭射卡生成器 ====================
|
||
# LASER_GEN_PROVIDER:
|
||
# minimax (默认) - 后端直连 MiniMax, 并行 5 variant 生成背景+装饰, 再调 compositor 合成
|
||
# dify - 调 Dify laser_card_variants_v1 工作流, 由 Dify 内部分发
|
||
# openai - 后端直连 OpenAI /v1/images/edits, 5 路并发 + 直接落 OSS (不调 compositor)
|
||
# relay-dify - Dify 增强 prompt → 中转站 edits → 落 OSS（单张调试，可扩展）
|
||
LASER_GEN_PROVIDER=openai
|
||
|
||
# ==================== OpenAI Images API (LASER_GEN_PROVIDER=openai 时使用) ====================
|
||
# 必填:OpenAI API Key(去 https://platform.openai.com/api-keys 生成)
|
||
OPENAI_API_KEY=<REPLACE_ME_OPENAI_KEY>
|
||
# 可选:API 端点(默认官方地址;如使用代理或自建兼容服务可改)
|
||
OPENAI_BASE_URL=https://api.openai.com/v1
|
||
# 可选:模型名(默认 gpt-image-1.5;可选 gpt-image-1 / dall-e-3)
|
||
OPENAI_MODEL=gpt-image-1.5
|
||
# laser-compositor 内网地址
|
||
# 注意：7000 端口在 macOS 上被 AirPlay Receiver 占用，因此改用 7002
|
||
LASER_COMPOSITOR_URL=http://127.0.0.1:7002
|
||
# laser-compositor 监听端口（与 URL 端口一致）
|
||
COMPOSITOR_PORT=7002
|
||
|
||
# ==================== Mobile Push (uniPush) ====================
|
||
# 通知服务使用：通知创建后通过 uniCloud sendMessage 云函数触发手机通知栏
|
||
# 以下变量由 notificationService 进程读取（见 deploy/envs/notification.env）
|
||
# 注意：生产 URL 走环境变量注入，不要提交到代码仓库
|
||
PUSH_ENABLED=true
|
||
PUSH_URL=
|
||
PUSH_TIMEOUT_MS=4000
|
||
OPENAI_API_KEY=<REPLACE_ME_OPENAI_WEDA_KEY>
|
||
# 微达API BaseURL（必须含 /v1 后缀，代码会拼成 /v1/images/edits）
|
||
OPENAI_BASE_URL=https://api.weda.cc/v1
|
||
# 中转站实际暴露的 image 模型
|
||
OPENAI_MODEL=gpt-image-2
|
||
|
||
# ==================== aichatdify ====================
|
||
DIFY_API_KEY=<REPLACE_ME_DIFY_KEY>
|
||
DIFY_API_BASE=http://localhost/v1
|
||
DIFY_TIMEOUT_SEC=60
|
||
|
||
# ==================== 周边防伪验真（peripheral_verify）====================
|
||
# 详见 docs/design/peripheral-verify.md §5.1
|
||
|
||
# ⚠️ 关键:必须与 TopFans-activity-admin/backend/.env 中的 PERIPHERAL_SECRET_KEY 完全一致
|
||
# 用于 Go gateway 验真接口的 HMAC 签名校验
|
||
# 决策 #9:永不轮换,仅在泄露时更换
|
||
# 生成命令:python3 -c "import secrets; print(secrets.token_hex(64))"
|
||
SECRET_KEY=
|