mirror of
https://github.com/iflytek/skillhub.git
synced 2026-09-24 00:55:35 +00:00
5800d4ddbb
AGENTS.md and CONTRIBUTING.md both require docs updates when auth flows or deployment config change; this batch changed both and touched no docs. 03-authentication-design.md described adding a provider as "branch on registrationId inside CustomOAuth2UserService", which the ProviderOAuth2UserService strategy supersedes. Rewrites that recipe: register an OAuthClaimsExtractor bean per provider, add a ProviderOAuth2UserService only when the userinfo response is non-standard, and note that the login page needs no code change. Also records the provider-side obligations that are easy to get wrong -- stable subject with no fallback, emailVerified only on proven ownership, bounded remote calls, no subject in logs -- and un-comments the config example, which still listed GitLab as a future possibility. faq.md told operators to delete "the github and gitlab blocks" to hide SSO buttons. That advice was already incomplete and gets worse per provider, so it now explains the config-driven mechanism: an empty client id keeps the entry off the login page, no file edit needed. 09-deployment.md listed only the GitHub credentials. Adds GitLab and Feishu, and flags a deployment trap: Feishu emails are admin-imported so emailVerified is always false, and skillhub.access-policy.mode=EMAIL_DOMAIN denies every unverified email, which would reject all Feishu logins. Squares the Feishu logo viewBox. It was 407.87x324.19 while login-button renders it in a square w-5 h-5 box, so the mark was distorted. Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
184 lines
8.3 KiB
Text
184 lines
8.3 KiB
Text
# `latest` tracks the latest stable release image.
|
|
# For deterministic environments, pin a release tag like `v0.1.0`.
|
|
# Use `edge` only when you explicitly want the latest build from `main`.
|
|
SKILLHUB_VERSION=latest
|
|
SKILLHUB_SERVER_IMAGE=ghcr.io/iflytek/skillhub-server
|
|
SKILLHUB_WEB_IMAGE=ghcr.io/iflytek/skillhub-web
|
|
SKILLHUB_SCANNER_IMAGE=ghcr.io/iflytek/skillhub-scanner
|
|
POSTGRES_IMAGE=postgres:16-alpine
|
|
REDIS_IMAGE=redis:7-alpine
|
|
|
|
# Public entrypoint seen by browsers/CLI, no trailing slash.
|
|
# Default to localhost so `runtime.sh up` works as a zero-config quickstart.
|
|
SKILLHUB_PUBLIC_BASE_URL=http://localhost
|
|
|
|
# Suite Bundle rollout controls. Confirmation is opt-in; review writes remain enabled
|
|
# for the single-server release Compose topology.
|
|
SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED=false
|
|
SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=true
|
|
|
|
# Frontend usually keeps this empty and proxies to the backend through nginx.
|
|
SKILLHUB_WEB_API_BASE_URL=
|
|
SKILLHUB_API_UPSTREAM=http://server:8080
|
|
# Keep false for direct exposure. Enable only behind a trusted proxy that replaces
|
|
# X-Forwarded-Proto and blocks direct access to the web container.
|
|
SKILLHUB_TRUST_FORWARDED_PROTO=false
|
|
|
|
# Sub-path deployment example. Keep all three public/browser values aligned:
|
|
# SKILLHUB_PUBLIC_BASE_URL=https://example.com/skillhub
|
|
# SKILLHUB_WEB_API_BASE_URL=/skillhub
|
|
# SKILLHUB_WEB_BASE_PATH=/skillhub/
|
|
# Leave empty so a fixed-base image keeps its baked base; set to a sub-path to override.
|
|
SKILLHUB_WEB_BASE_PATH=
|
|
|
|
POSTGRES_BIND_ADDRESS=127.0.0.1
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=skillhub
|
|
POSTGRES_USER=skillhub
|
|
POSTGRES_PASSWORD=change-this-postgres-password
|
|
|
|
REDIS_BIND_ADDRESS=127.0.0.1
|
|
REDIS_PORT=6379
|
|
|
|
# Optional external Redis connection. Leave these commented to use the bundled
|
|
# standalone Redis service. For Redis Cluster, every advertised node address
|
|
# must be reachable from the server container.
|
|
# SPRING_DATA_REDIS_CLUSTER_NODES=redis-0.example.com:6379,redis-1.example.com:6379,redis-2.example.com:6379
|
|
# SPRING_DATA_REDIS_CLUSTER_MAX_REDIRECTS=5
|
|
# SPRING_DATA_REDIS_USERNAME=
|
|
# SPRING_DATA_REDIS_PASSWORD=
|
|
# SPRING_DATA_REDIS_SSL_ENABLED=false
|
|
# SPRING_DATA_REDIS_CONNECT_TIMEOUT=5s
|
|
# SPRING_DATA_REDIS_TIMEOUT=3s
|
|
# SPRING_DATA_REDIS_CLIENT_NAME=skillhub
|
|
|
|
# Optional external Redis Sentinel. Sentinel takes precedence if both Sentinel
|
|
# and Cluster settings are present. Use separate credentials when Sentinel ACL
|
|
# differs from the Redis data nodes.
|
|
# SPRING_DATA_REDIS_SENTINEL_MASTER=mymaster
|
|
# SPRING_DATA_REDIS_SENTINEL_NODES=sentinel-0.example.com:26379,sentinel-1.example.com:26379,sentinel-2.example.com:26379
|
|
# SPRING_DATA_REDIS_SENTINEL_USERNAME=
|
|
# SPRING_DATA_REDIS_SENTINEL_PASSWORD=
|
|
# SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST=true
|
|
|
|
API_PORT=8080
|
|
WEB_PORT=80
|
|
SESSION_COOKIE_SECURE=false
|
|
|
|
# Observability defaults require no Collector or tracing backend.
|
|
# Use json in container deployments when stdout is collected centrally.
|
|
SKILLHUB_TRACING_MODE=none
|
|
SKILLHUB_LOG_FORMAT=json
|
|
SKILLHUB_LOG_ASYNC_QUEUE_SIZE=1024
|
|
SKILLHUB_SERVICE_VERSION=unknown
|
|
SKILLHUB_SERVICE_ENVIRONMENT=production
|
|
SKILLHUB_TRACING_SAMPLING_PROBABILITY=0.1
|
|
# Set only with SKILLHUB_TRACING_MODE=otel-sdk.
|
|
MANAGEMENT_OTLP_TRACING_ENDPOINT=
|
|
SKILLHUB_OTLP_TIMEOUT=5s
|
|
SKILLHUB_OTLP_COMPRESSION=gzip
|
|
|
|
# Zero-config runtime validation uses local storage.
|
|
# Switch to `s3` and fill the fields below before a real production deployment.
|
|
SKILLHUB_STORAGE_PROVIDER=local
|
|
SKILLHUB_STORAGE_S3_ENDPOINT=https://oss-cn-example.aliyuncs.com
|
|
SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT=
|
|
SKILLHUB_STORAGE_S3_BUCKET=skillhub-prod
|
|
# Static credentials for S3-compatible storage (MinIO, Alibaba OSS, etc.).
|
|
# Leave both blank to use IAM authentication (EC2 instance profile, ECS task role, EKS IRSA).
|
|
SKILLHUB_STORAGE_S3_ACCESS_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_SECRET_KEY=replace-me
|
|
SKILLHUB_STORAGE_S3_REGION=cn-shanghai
|
|
SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE=false
|
|
# Aliyun OSS rejects aws-chunked encoding; set to true when targeting Aliyun OSS.
|
|
SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING=true
|
|
SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET=false
|
|
SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY=PT10M
|
|
|
|
# Bootstrap local admin account for first login. Rotate or disable after initial setup.
|
|
BOOTSTRAP_ADMIN_ENABLED=true
|
|
BOOTSTRAP_ADMIN_USER_ID=docker-admin
|
|
BOOTSTRAP_ADMIN_USERNAME=admin
|
|
BOOTSTRAP_ADMIN_PASSWORD=ChangeMe!2026
|
|
BOOTSTRAP_ADMIN_DISPLAY_NAME=Platform Admin
|
|
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
|
|
|
|
# Optional override. Defaults to ${SKILLHUB_PUBLIC_BASE_URL}/device.
|
|
DEVICE_AUTH_VERIFICATION_URI=
|
|
|
|
# Optional: configure real GitHub OAuth before exposing the stack to other users.
|
|
OAUTH2_GITHUB_CLIENT_ID=
|
|
OAUTH2_GITHUB_CLIENT_SECRET=
|
|
|
|
# Optional: configure real GitLab OAuth before exposing the stack to other users.
|
|
# Set OAUTH2_GITLAB_BASE_URI to your self-hosted GitLab URL when applicable.
|
|
OAUTH2_GITLAB_CLIENT_ID=
|
|
OAUTH2_GITLAB_CLIENT_SECRET=
|
|
OAUTH2_GITLAB_BASE_URI=https://gitlab.com
|
|
OAUTH2_GITLAB_DISPLAY_NAME=GitLab
|
|
|
|
# Optional: Feishu (Lark) login as a public sign-in provider. Leaving the client id empty keeps
|
|
# the button off the login page. Grant contact:user.base:readonly and
|
|
# contact:user.email:readonly on the Feishu open-platform app itself; scopes are not sent here.
|
|
# Set OAUTH2_FEISHU_AUTHORIZE_URI/OAUTH2_FEISHU_BASE_URI to the Lark endpoints for
|
|
# international tenants (open.larksuite.com).
|
|
# Feishu emails are admin-imported and never confirmed with the user, so emailVerified is always
|
|
# false. If you set skillhub.access-policy.mode=EMAIL_DOMAIN in application.yml, that policy
|
|
# denies every unverified email and Feishu login will always fail; keep the default OPEN mode,
|
|
# or use another policy, when enabling this provider.
|
|
OAUTH2_FEISHU_CLIENT_ID=
|
|
OAUTH2_FEISHU_CLIENT_SECRET=
|
|
OAUTH2_FEISHU_AUTHORIZE_URI=https://accounts.feishu.cn
|
|
OAUTH2_FEISHU_BASE_URI=https://open.feishu.cn
|
|
OAUTH2_FEISHU_DISPLAY_NAME=飞书
|
|
|
|
# Optional: OIDC login (e.g. Keycloak, Okta, Azure AD).
|
|
# Replace "OIDC" in variable names with your registration id (uppercase).
|
|
# The registration id becomes identity_binding.provider_code — keep it stable.
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_ID=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_SECRET=
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_PROVIDER=oidc
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_AUTHORIZATION_GRANT_TYPE=authorization_code
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_SCOPE=openid,profile,email
|
|
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_OIDC_CLIENT_NAME=OIDC
|
|
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI=
|
|
|
|
# Direct (username/password) authentication for environments without OAuth2.
|
|
# To enable, set BOTH:
|
|
# - SKILLHUB_AUTH_DIRECT_ENABLED=true (server: enables the /api/v1/auth/direct endpoint)
|
|
# - SKILLHUB_WEB_AUTH_DIRECT_ENABLED=true (web: surfaces the username/password form)
|
|
# Set SKILLHUB_WEB_AUTH_DIRECT_PROVIDER to a direct provider id returned by
|
|
# /api/v1/auth/methods (e.g. "local"). Do not use the built-in auth method id
|
|
# "local-password" here; that method points at /api/v1/auth/local/login.
|
|
SKILLHUB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_ENABLED=false
|
|
SKILLHUB_WEB_AUTH_DIRECT_PROVIDER=
|
|
|
|
# SMTP configuration for password reset verification emails.
|
|
SPRING_MAIL_HOST=
|
|
SPRING_MAIL_PORT=587
|
|
SPRING_MAIL_USERNAME=
|
|
SPRING_MAIL_PASSWORD=
|
|
SPRING_MAIL_SMTP_AUTH=true
|
|
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=false
|
|
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=
|
|
SKILLHUB_AUTH_PASSWORD_RESET_CODE_EXPIRY=PT10M
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_ADDRESS=noreply@example.com
|
|
SKILLHUB_AUTH_PASSWORD_RESET_FROM_NAME=SkillHub
|
|
|
|
# Security scanner is enabled by default. Set to false to disable scanning.
|
|
SKILLHUB_SECURITY_SCANNER_ENABLED=true
|
|
|
|
# Built-in starter skills are installed by default. Set to false to skip initialization.
|
|
SKILLHUB_BUILTIN_SKILLS_ENABLED=true
|
|
|
|
# Required for signing anonymous download rate-limit cookies. Use a unique random value per deployment.
|
|
# runtime.sh generates and persists one automatically when this placeholder is still present.
|
|
SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET=replace-with-random-download-secret-32-bytes
|
|
|
|
# Scanner LLM configuration (optional, for AI-powered scanning features)
|
|
SKILL_SCANNER_LLM_API_KEY=
|
|
SKILL_SCANNER_LLM_BASE_URL=
|
|
SKILL_SCANNER_LLM_MODEL=
|