d7011163b8
安全修复（P0）： - 移除硬编码的 OAuth client_secret（Antigravity、Gemini CLI）， 改为通过环境变量注入（ANTIGRAVITY_OAUTH_CLIENT_SECRET、 GEMINI_CLI_OAUTH_CLIENT_SECRET） - 新增 logredact.RedactText() 对非结构化文本做敏感信息脱敏， 覆盖 GOCSPX-*/AIza* 令牌和常见 key=value 模式 - 日志中不再打印 org_uuid、account_uuid、email_address 等敏感值 安全修复（P1）： - URL 验证增强：新增 ValidateHTTPURL 统一入口，支持 allowlist 和 私网地址阻断（localhost/内网 IP） - 代理回退安全：代理初始化失败时默认阻止直连回退，防止 IP 泄露， 可通过 security.proxy_fallback.allow_direct_on_error 显式开启 - Gemini OAuth 配置校验：client_id 与 client_secret 必须同时 设置或同时留空 其他改进： - 新增 tools/secret_scan.py 密钥扫描工具和 Makefile secret-scan 目标 - 更新所有 docker-compose 和部署配置，传递 OAuth secret 环境变量 - google_one OAuth 类型使用固定 redirectURI，与 code_assist 对齐 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
106 lines
4.5 KiB
YAML
106 lines
4.5 KiB
YAML
# =============================================================================
|
|
# Sub2API Docker Compose - Standalone Configuration
|
|
# =============================================================================
|
|
# This configuration runs only the Sub2API application.
|
|
# PostgreSQL and Redis must be provided externally.
|
|
#
|
|
# Usage:
|
|
# 1. Copy .env.example to .env and configure database/redis connection
|
|
# 2. docker-compose -f docker-compose.standalone.yml up -d
|
|
# 3. Access: http://localhost:8080
|
|
# =============================================================================
|
|
|
|
services:
|
|
sub2api:
|
|
image: weishaw/sub2api:latest
|
|
container_name: sub2api
|
|
restart: unless-stopped
|
|
ulimits:
|
|
nofile:
|
|
soft: 100000
|
|
hard: 100000
|
|
ports:
|
|
- "${BIND_HOST:-0.0.0.0}:${SERVER_PORT:-8080}:8080"
|
|
volumes:
|
|
- sub2api_data:/app/data
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
environment:
|
|
# =======================================================================
|
|
# Auto Setup
|
|
# =======================================================================
|
|
- AUTO_SETUP=true
|
|
|
|
# =======================================================================
|
|
# Server Configuration
|
|
# =======================================================================
|
|
- SERVER_HOST=0.0.0.0
|
|
- SERVER_PORT=8080
|
|
- SERVER_MODE=${SERVER_MODE:-release}
|
|
- RUN_MODE=${RUN_MODE:-standard}
|
|
|
|
# =======================================================================
|
|
# Database Configuration (PostgreSQL) - Required
|
|
# =======================================================================
|
|
- DATABASE_HOST=${DATABASE_HOST:?DATABASE_HOST is required}
|
|
- DATABASE_PORT=${DATABASE_PORT:-5432}
|
|
- DATABASE_USER=${DATABASE_USER:-sub2api}
|
|
- DATABASE_PASSWORD=${DATABASE_PASSWORD:?DATABASE_PASSWORD is required}
|
|
- DATABASE_DBNAME=${DATABASE_DBNAME:-sub2api}
|
|
- DATABASE_SSLMODE=${DATABASE_SSLMODE:-disable}
|
|
- DATABASE_MAX_OPEN_CONNS=${DATABASE_MAX_OPEN_CONNS:-50}
|
|
- DATABASE_MAX_IDLE_CONNS=${DATABASE_MAX_IDLE_CONNS:-10}
|
|
- DATABASE_CONN_MAX_LIFETIME_MINUTES=${DATABASE_CONN_MAX_LIFETIME_MINUTES:-30}
|
|
- DATABASE_CONN_MAX_IDLE_TIME_MINUTES=${DATABASE_CONN_MAX_IDLE_TIME_MINUTES:-5}
|
|
|
|
# =======================================================================
|
|
# Redis Configuration - Required
|
|
# =======================================================================
|
|
- REDIS_HOST=${REDIS_HOST:?REDIS_HOST is required}
|
|
- REDIS_PORT=${REDIS_PORT:-6379}
|
|
- REDIS_PASSWORD=${REDIS_PASSWORD:-}
|
|
- REDIS_DB=${REDIS_DB:-0}
|
|
- REDIS_POOL_SIZE=${REDIS_POOL_SIZE:-1024}
|
|
- REDIS_MIN_IDLE_CONNS=${REDIS_MIN_IDLE_CONNS:-10}
|
|
- REDIS_ENABLE_TLS=${REDIS_ENABLE_TLS:-false}
|
|
|
|
# =======================================================================
|
|
# Admin Account (auto-created on first run)
|
|
# =======================================================================
|
|
- ADMIN_EMAIL=${ADMIN_EMAIL:-admin@sub2api.local}
|
|
- ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
|
|
|
|
# =======================================================================
|
|
# JWT Configuration
|
|
# =======================================================================
|
|
- JWT_SECRET=${JWT_SECRET:-}
|
|
- JWT_EXPIRE_HOUR=${JWT_EXPIRE_HOUR:-24}
|
|
|
|
# =======================================================================
|
|
# Timezone Configuration
|
|
# =======================================================================
|
|
- TZ=${TZ:-Asia/Shanghai}
|
|
|
|
# =======================================================================
|
|
# Gemini OAuth Configuration (optional)
|
|
# =======================================================================
|
|
- GEMINI_OAUTH_CLIENT_ID=${GEMINI_OAUTH_CLIENT_ID:-}
|
|
- GEMINI_OAUTH_CLIENT_SECRET=${GEMINI_OAUTH_CLIENT_SECRET:-}
|
|
- GEMINI_OAUTH_SCOPES=${GEMINI_OAUTH_SCOPES:-}
|
|
- GEMINI_QUOTA_POLICY=${GEMINI_QUOTA_POLICY:-}
|
|
|
|
# Built-in OAuth client secrets (optional)
|
|
# SECURITY: This repo does not embed third-party client_secret.
|
|
- GEMINI_CLI_OAUTH_CLIENT_SECRET=${GEMINI_CLI_OAUTH_CLIENT_SECRET:-}
|
|
- ANTIGRAVITY_OAUTH_CLIENT_SECRET=${ANTIGRAVITY_OAUTH_CLIENT_SECRET:-}
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 30s
|
|
|
|
volumes:
|
|
sub2api_data:
|
|
driver: local
|