mirror of
https://github.com/iflytek/skillhub.git
synced 2026-08-27 11:14:59 +00:00
55e5c1e10e
* feat(observability): establish request correlation boundary Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): add selectable tracing modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate async trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * docs(observability): document tracing deployment modes Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): tighten tracing integration boundaries Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): harden operational log privacy Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * feat(observability): propagate message trace context Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): document message propagation semantics Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * test(auth): isolate security context between tests Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> * fix(observability): skip otlp exporter without endpoint Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com> --------- Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
155 lines
6.7 KiB
Text
155 lines
6.7 KiB
Text
# `latest` tracks the latest stable release image.
|
|
# For deterministic environments, pin a release tag like `v0.1.0`.
|
|
# Use `edge` only when you explicitly want the latest build from `main`.
|
|
SKILLHUB_VERSION=latest
|
|
SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
|
|
SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
|
|
SKILLHUB_SCANNER_IMAGE=ghcr.io/iflytek/skillhub-scanner
|
|
POSTGRES_IMAGE=postgres:16-alpine
|
|
REDIS_IMAGE=redis:7-alpine
|
|
|
|
# Public entrypoint seen by browsers/CLI, no trailing slash.
|
|
# Default to localhost so `runtime.sh up` works as a zero-config quickstart.
|
|
SKILLHUB_PUBLIC_BASE_URL=http://localhost
|
|
|
|
# Frontend usually keeps this empty and proxies to the backend through nginx.
|
|
SKILLHUB_WEB_API_BASE_URL=
|
|
SKILLHUB_API_UPSTREAM=http://server:8080
|
|
# Keep false for direct exposure. Enable only behind a trusted proxy that replaces
|
|
# X-Forwarded-Proto and blocks direct access to the web container.
|
|
SKILLHUB_TRUST_FORWARDED_PROTO=false
|
|
|
|
POSTGRES_BIND_ADDRESS=127.0.0.1
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=skillhub
|
|
POSTGRES_USER=skillhub
|
|
POSTGRES_PASSWORD=change-this-postgres-password
|
|
|
|
REDIS_BIND_ADDRESS=127.0.0.1
|
|
REDIS_PORT=6379
|
|
|
|
# Optional external Redis connection. Leave these commented to use the bundled
|
|
# standalone Redis service. For Redis Cluster, every advertised node address
|
|
# must be reachable from the server container.
|
|
# SPRING_DATA_REDIS_CLUSTER_NODES=redis-0.example.com:6379,redis-1.example.com:6379,redis-2.example.com:6379
|
|
# SPRING_DATA_REDIS_CLUSTER_MAX_REDIRECTS=5
|
|
# SPRING_DATA_REDIS_USERNAME=
|
|
# SPRING_DATA_REDIS_PASSWORD=
|
|
# SPRING_DATA_REDIS_SSL_ENABLED=false
|
|
# SPRING_DATA_REDIS_CONNECT_TIMEOUT=5s
|
|
# SPRING_DATA_REDIS_TIMEOUT=3s
|
|
# SPRING_DATA_REDIS_CLIENT_NAME=skillhub
|
|
|
|
# Optional external Redis Sentinel. Sentinel takes precedence if both Sentinel
|
|
# and Cluster settings are present. Use separate credentials when Sentinel ACL
|
|
# differs from the Redis data nodes.
|
|
# SPRING_DATA_REDIS_SENTINEL_MASTER=mymaster
|
|
# SPRING_DATA_REDIS_SENTINEL_NODES=sentinel-0.example.com:26379,sentinel-1.example.com:26379,sentinel-2.example.com:26379
|
|
# SPRING_DATA_REDIS_SENTINEL_USERNAME=
|
|
# SPRING_DATA_REDIS_SENTINEL_PASSWORD=
|
|
# SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST=true
|
|
|
|
API_PORT=8080
|
|
WEB_PORT=80
|
|
SESSION_COOKIE_SECURE=false
|
|
|
|
# Observability defaults require no Collector or tracing backend.
|
|
# Use json in container deployments when stdout is collected centrally.
|
|
SKILLHUB_TRACING_MODE=none
|
|
SKILLHUB_LOG_FORMAT=json
|
|
SKILLHUB_LOG_ASYNC_QUEUE_SIZE=1024
|
|
SKILLHUB_SERVICE_VERSION=unknown
|
|
SKILLHUB_SERVICE_ENVIRONMENT=production
|
|
SKILLHUB_TRACING_SAMPLING_PROBABILITY=0.1
|
|
# Set only with SKILLHUB_TRACING_MODE=otel-sdk.
|
|
MANAGEMENT_OTLP_TRACING_ENDPOINT=
|
|
SKILLHUB_OTLP_TIMEOUT=5s
|
|
SKILLHUB_OTLP_COMPRESSION=gzip
|
|
|
|
# Zero-config runtime validation uses local storage.
|
|
# Switch to `s3` and fill the fields below before a real production deployment.
|
|
SKILLHUB_STORAGE_PROVIDER=local
|
|
SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-example.aliyuncs.com
|
|
SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
|
|
SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
|
|
# Static credentials for S3-compatible storage (MinIO, Alibaba OSS, etc.).
|
|
# Leave both blank to use IAM authentication (EC2 instance profile, ECS task role, EKS IRSA).
|
|
SKILLHUB_STORAGE_S3_ACCESS_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_SECRET_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_REGION=cn-shanghai
|
|
SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
|
|
# Aliyun OSS rejects aws-chunked encoding; set to true when targeting Aliyun OSS.
|
|
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true
|
|
SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
|
|
SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
|
|
|
|
# Bootstrap local admin account for first login. Rotate or disable after initial setup.
|
|
BOOTSTRAP_ADMIN_ENABLED=true
|
|
BOOTSTRAP_ADMIN_USER_ID=docker-admin
|
|
BOOTSTRAP_ADMIN_USERNAME=admin
|
|
BOOTSTRAP_ADMIN_PASSWORD=ChangeMe!2026
|
|
BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
|
|
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
|
|
|
|
# Optional override. Defaults to ${SKILLHUB_PUBLIC_BASE_URL}/device.
|
|
DEVICE_AUTH_VERIFICATION_URI=
|
|
|
|
# Optional: configure real GitHub OAuth before exposing the stack to other users.
|
|
OAUTH2_GITHUB_CLIENT_ID=
|
|
OAUTH2_GITHUB_CLIENT_SECRET=
|
|
|
|
# Optional: configure real GitLab OAuth before exposing the stack to other users.
|
|
# Set OAUTH2_GITLAB_BASE_URI to your self-hosted GitLab URL when applicable.
|
|
OAUTH2_GITLAB_CLIENT_ID=
|
|
OAUTH2_GITLAB_CLIENT_SECRET=
|
|
OAUTH2_GITLAB_BASE_URI=https://gitlab.com
|
|
OAUTH2_GITLAB_DISPLAY_NAME=GitLab
|
|
|
|
# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).
|
|
# Replace "OIDC" in variable names with your registration id (uppercase).
|
|
# The registration id becomes identity_binding.provider_code — keep it stable.
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_PROVIDER=oidc
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_AUTHORIZATION_GRANT_TYPE=authorization_code
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC
|
|
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=
|
|
|
|
# Direct (username/password) authentication for environments without OAuth2.
|
|
# To enable, set BOTH:
|
|
# - SKILLHUB_AUTH_DIRECT_ENABLED=true (server: enables the /api/v1/auth/direct endpoint)
|
|
# - SKILLHUB_WEB_AUTH_DIRECT_ENABLED=true (web: surfaces the username/password form)
|
|
# Set SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to the provider id (e.g. "local").
|
|
SKILLHUB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=
|
|
|
|
# SMTP configuration for password reset verification emails.
|
|
SPRING_MAIL_HOST=
|
|
SPRING_MAIL_PORT=587
|
|
SPRING_MAIL_USERNAME=
|
|
SPRING_MAIL_PASSWORD=
|
|
SPRING_MAIL_SMTP_AUTH=true
|
|
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=false
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=
|
|
SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY=PT10M
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS=noreply@example.com
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_NAME=SkillHub
|
|
|
|
# Security scanner is enabled by default. Set to false to disable scanning.
|
|
SKILLHUB_SECURITY_SCANNER_ENABLED=true
|
|
|
|
# Built-in starter skills are installed by default. Set to false to skip initialization.
|
|
SKILLHUB_BUILTIN_SKILLS_ENABLED=true
|
|
|
|
# Required for signing anonymous download rate-limit cookies. Use a unique random value per deployment.
|
|
# runtime.sh generates and persists one automatically when this placeholder is still present.
|
|
SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET=replace-with-random-download-secret-32-bytes
|
|
|
|
# Scanner LLM configuration (optional, for AI-powered scanning features)
|
|
SKILL_SCANNER_LLM_API_KEY=
|
|
SKILL_SCANNER_LLM_BASE_URL=
|
|
SKILL_SCANNER_LLM_MODEL=
|