From 596d2af83000b025fa5ebb674e93cc6a62177e3a Mon Sep 17 00:00:00 2001 From: DaxPay Dev Date: Tue, 23 Jun 2026 08:48:22 +0800 Subject: [PATCH] =?UTF-8?q?feat(config):=20=E6=8B=86=E5=88=86=20dev/prod?= =?UTF-8?q?=20profile,=20=E6=96=B0=E5=A2=9E=E7=94=9F=E4=BA=A7=E7=8E=AF?= =?UTF-8?q?=E5=A2=83=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - application.yml: 移除 management.endpoints/health 块下沉到各 profile; tracing sampling 默认 1.0 - application-dev.yml: 顶部新增 management 块(11 个排障端点 + show-details: always) - application-prod.yml: 新建, Docker Compose 部署 + 凭证环境变量占位符 + 优雅停机 + liveness/readiness 探针分组 - channel: dev/prod 统一注释体系(one/two/three 编号规则与子应用分配), prod 用 \ 占位 - prod 安全收紧: 关闭 Swagger 与超管后门, actuator 仅 health/info/metrics, ignore-urls 移除 /** --- .../src/main/resources/application-dev.yml | 35 ++++- .../src/main/resources/application-prod.yml | 144 ++++++++++++++++++ .../src/main/resources/application.yml | 17 +-- 3 files changed, 173 insertions(+), 23 deletions(-) create mode 100644 daxpay-start/src/main/resources/application-prod.yml diff --git a/daxpay-start/src/main/resources/application-dev.yml b/daxpay-start/src/main/resources/application-dev.yml index ad28b9c07..c7cf6dfa2 100644 --- a/daxpay-start/src/main/resources/application-dev.yml +++ b/daxpay-start/src/main/resources/application-dev.yml @@ -1,3 +1,16 @@ +# 开发期监控端点配置(无敏感数据, 排障友好; prod 收紧版本见 application-prod.yml) +management: + endpoints: + web: + exposure: + include: > + health,info,httpexchanges, + metrics,loggers,threaddump, + beans,mappings,scheduledtasks, + caches,conditions,startup + endpoint: + health: + show-details: always spring: datasource: # Postgresql连接 @@ -50,9 +63,6 @@ spring: logging: level: cn.daxpay.open.**: debug - # 打印请求头和响应头（不含 body） -# org.apache.hc.client5.http.wire: DEBUG -# org.apache.hc.client5.http.headers: DEBUG # 接口文档配置 springdoc: # 默认展开对象类型的属性, 主要用在get类型的参数中 @@ -64,9 +74,6 @@ springdoc: daxpay: platform: common: - # 通道适配服务配置(daxpay-channel-one, 独立部署的通道对接子服务) - channel-one: - base-url: http://127.0.0.1:20100 # 错误信息配置 exception: show-full-message: true @@ -147,4 +154,18 @@ daxpay: enable: true keys: - key: z0Vd8jDKB80pA6OOptGLO+qDVvWboEko - version: 1 \ No newline at end of file + version: 1 + # 通道适配子应用配置 + # 按支付通道拆分的独立部署子服务, 主服务通过 HTTP 调用对应子服务完成通道对接。 + # 拆分目的: 通道 SDK 依赖隔离(避免冲突) + 独立升级 + 弹性伸缩 + # 子应用编号(one/two/three)固定且不可改名, 与路由策略中的通道分配一一对应。 + channel: + # 子应用1: 支付宝 + 微信支付(已启用, 本机启动的 dax-pay-channel-one 服务) + one: + base-url: http://127.0.0.1:20100 + # 子应用2: 银联 + 拉卡拉(未来扩展, 暂未启用) + # two: + # base-url: http://127.0.0.1:20200 + # 子应用3: 抖音 + 其他通道(未来扩展, 暂未启用) + # three: + # base-url: http://127.0.0.1:20300 \ No newline at end of file diff --git a/daxpay-start/src/main/resources/application-prod.yml b/daxpay-start/src/main/resources/application-prod.yml new file mode 100644 index 000000000..b62a2cb02 --- /dev/null +++ b/daxpay-start/src/main/resources/application-prod.yml @@ -0,0 +1,144 @@ +# ==================================================================== +# DaxPay 开源版 - 生产环境配置 +# ==================================================================== +# 部署形态: Docker Compose / 单机容器 +# 凭证注入: 所有敏感字段用 ${VAR} 占位符, 由 docker-compose 的 +# env_file 或 environment 注入, 真实 .env 文件不入库。 +# 启动方式: docker run -e SPRING_PROFILES_ACTIVE=prod \ +# -e DB_PASSWORD=... -e ... daxpay-union +# 采样率: 与 dev 一致 1.0(全采样, 不导出 trace 到后端时无存储成本, +# 全采样能让任意请求的日志都能用 traceId 串起来排障) +# ==================================================================== + +server: + port: ${SERVER_PORT:9999} + # 优雅停机(配合 docker stop 的 10s 宽限期) + shutdown: graceful +spring: + lifecycle: + timeout-per-shutdown-phase: 30s + # PostgreSQL 数据库(凭证环境变量注入) + datasource: + driver-class-name: org.postgresql.Driver + url: jdbc:postgresql://${DB_HOST:postgresql}:${DB_PORT:5432}/${DB_NAME:daxpay-prod}?autoReconnect=true&reWriteBatchedInserts=true + username: ${DB_USERNAME:?missing DB_USERNAME} + password: ${DB_PASSWORD:?missing DB_PASSWORD} + hikari: + minimumIdle: 10 + maximumPoolSize: 100 + leak-detection-threshold: 30000 + connection-timeout: 30000 + idle-timeout: 600000 + max-lifetime: 1800000 + # Redis(凭证环境变量注入) + data: + redis: + host: ${REDIS_HOST:redis} + port: ${REDIS_PORT:6379} + database: ${REDIS_DATABASE:0} + password: ${REDIS_PASSWORD:?missing REDIS_PASSWORD} + lettuce: + pool: + max-wait: 1000ms + # Artemis 消息队列(凭证环境变量注入) + artemis: + mode: native + broker-url: ${ARTEMIS_BROKER_URL:tcp://artemis:61616} + user: ${ARTEMIS_USER:?missing ARTEMIS_USER} + password: ${ARTEMIS_PASSWORD:?missing ARTEMIS_PASSWORD} + pool: + enabled: true + max-connections: 20 + idle-timeout: 30s + jms: + cache: + enabled: true + session-cache-size: 20 + pub-sub-domain: false + listener: + auto-startup: true +# 日志(生产只输出 INFO 及以上, 业务包不切 DEBUG) +logging: + level: + root: INFO + cn.daxpay.open.**: INFO +# API 文档(生产关闭, 不暴露接口结构给潜在攻击者) +springdoc: + api-docs: + enabled: false + swagger-ui: + enabled: false +# 监控端点(Docker Compose 场景与业务同端口, 收紧到最小必要集) +management: + endpoints: + web: + exposure: + # 不开 env/heapdump/beans 等敏感端点 + include: health,info,metrics + endpoint: + health: + # 生产不暴露 DB/Redis 内部状态给未授权方 + show-details: never + probes: + enabled: true + group: + # liveness 仅看进程存活(不级联 DB, 防止 DB 抖动引发雪崩) + liveness: + include: ping + # readiness 等 DB/Redis 就绪后才接流量 + readiness: + include: db,redis + # 链路追踪采样率(prod 与 dev 一致 1.0 全采样, 理由见文件头注释) + tracing: + sampling: + probability: 1.0 +# 基础脚手架配置 +daxpay: + platform: + common: + # 异常信息(生产不返回完整堆栈) + exception: + show-full-message: false + starter: + auth: + # 关闭超级管理员(生产不应有超管后门) + enable-admin: false + admin-in-list: false + # ignore-urls 严格收紧: 仅放行 health 探针和静态资源 + # 警告: 绝不能加 /** (dev 中那条会完全关闭认证) + ignore-urls: + - '/actuator/health' + - '/actuator/health/liveness' + - '/actuator/health/readiness' + - '/actuator/info' + - '/error' + - '/favicon.ico' + audit-log: + ip2region: + file-path: ${IP2REGION_FILE_PATH:/data/ip/ip2region_v4.xdb} + search-type: VECTOR_INDEX + config: + # RSA 密钥(PEM 文本通过环境变量注入) + key-config: + private-key: ${RSA_PRIVATE_KEY:?missing RSA_PRIVATE_KEY} + public-key: ${RSA_PUBLIC_KEY:?missing RSA_PUBLIC_KEY} + # 业务字段加密 + encrypt: + enable: true + keys: + - key: ${ENCRYPT_KEY:?missing ENCRYPT_KEY} + version: 1 + # 通道适配子应用配置 + # 按支付通道拆分的独立部署子服务, 主服务通过 HTTP 调用对应子服务完成通道对接。 + # 拆分目的: 通道 SDK 依赖隔离(避免冲突) + 独立升级 + 弹性伸缩 + # 子应用编号(one/two/three)固定且不可改名, 与路由策略中的通道分配一一对应。 + channel: + # 子应用1: 支付宝 + 微信支付(已启用, Docker Compose 中 channel-one 容器) + one: + base-url: ${CHANNEL_ONE_BASE_URL:http://channel-one:20100} + # 子应用2: 银联 + 拉卡拉(未来扩展, 暂未启用) + # two: + # base-url: ${CHANNEL_TWO_BASE_URL:http://channel-two:20200} + # 子应用3: 抖音 + 其他通道(未来扩展, 暂未启用) + # three: + # base-url: ${CHANNEL_THREE_BASE_URL:http://channel-three:20300} \ No newline at end of file diff --git a/daxpay-start/src/main/resources/application.yml b/daxpay-start/src/main/resources/application.yml index 4e2685048..c371b0760 100644 --- a/daxpay-start/src/main/resources/application.yml +++ b/daxpay-start/src/main/resources/application.yml @@ -15,21 +15,11 @@ spring: max-file-size: 100MB # 监控端点与链路追踪(actuator 配置必须放在顶层, 不能放在 spring: 下) management: - endpoints: - web: - exposure: - include: health,info,httpexchanges - endpoint: - health: - show-details: always - # 链路追踪配置(仅日志关联, 不导出到后端) + # 链路追踪配置(仅日志关联, 不导出到后端; 采样率 dev/prod 共享 1.0 全采样) tracing: sampling: probability: 1.0 # OTLP 导出开关(关闭后不向 OTLP 后端推送 trace) - # 注意: Spring Boot 4.1 中 enabled 标准键是 management.tracing.export.otlp.enabled, - # 与 endpoint/transport/headers 等连接细节(management.opentelemetry.tracing.export.otlp.*)分属不同前缀; - # 旧写法 management.opentelemetry.tracing.export.otlp.enabled 从未存在, 写了不生效。 export: otlp: enabled: false @@ -63,8 +53,3 @@ sa-token: is-share: true is-log: false is-print: false -# 字段翻译插件 -easy-trans: - #启用平铺模式 - is-enable-tile: true -