HH-439: harden production artifact pipeline (#86)

* HH-439: harden production artifact pipeline * fix(HH-439): address production compose review * fix(HH-439): preserve previous JWT secrets in production --------- Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-21 20:20:00 +08:00
parent 7e3872170f
commit 7a9fec33c5
11 changed files with 436 additions and 153 deletions
@@ -1,69 +1,28 @@
-# GoChat Environment Variables
-# Copy to .env and fill in your values. NEVER commit .env to git.
+# GoChat production variables. Copy to .env and replace every CHANGE_ME value.

-# ---- Application ----
-GOCHAT_ENV=prod
-# Keep disabled in production. Enable only for controlled QA/UAT environments.
+GOCHAT_IMAGE_REF=ghcr.io/rogeecn/gochat@sha256:CHANGE_ME
+GOCHAT_ENV=production
+GOCHAT_PORT=3000
+GOCHAT_SERVER_MODE=release
+GOCHAT_SERVER_CORS_ALLOWED_ORIGINS=https://chat.CHANGE_ME.example.com

-# ---- Server ----
-GOCHAT_SERVER_HOST=0.0.0.0
-GOCHAT_SERVER_PORT=3000
-GOCHAT_SERVER_MODE=release  # debug, release, test
+POSTGRES_DB=gochat_production
+POSTGRES_USER=gochat
+POSTGRES_PASSWORD=CHANGE_ME
+# The built-in PostgreSQL service is non-TLS. For an external database, set a
+# complete GOCHAT_DATABASE_DSN with sslmode=require, verify-ca, or verify-full.

-# ---- Database ----
-GOCHAT_DATABASE_DSN=postgres://gochat:CHANGE_ME_TO_A_STRONG_PASSWORD@localhost:5432/gochat_production?sslmode=disable
-GOCHAT_DATABASE_MAX_IDLE_CONNS=10
-GOCHAT_DATABASE_MAX_OPEN_CONNS=100
-GOCHAT_DATABASE_CONN_MAX_LIFETIME=3600
+POSTGRES_IMAGE_REF=pgvector/pgvector:pg16@sha256:ccc6e83d6e35e931dc7c5def2022729d5a6c370318d099181995567ff1fb4d6b
+REDIS_IMAGE_REF=redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
+MEILI_IMAGE_REF=getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae

-# ---- Redis ----
-GOCHAT_REDIS_DSN=redis://localhost:6379
-GOCHAT_REDIS_POOL_SIZE=50
-
-# ---- JWT ----
-GOCHAT_JWT_SECRET=CHANGE_ME_TO_A_RANDOM_64_CHAR_STRING
+REDIS_PASSWORD=CHANGE_ME
+MEILI_MASTER_KEY=CHANGE_ME
+GOCHAT_JWT_SECRET=CHANGE_ME_WITH_AT_LEAST_32_RANDOM_CHARACTERS
 # Optional during a bounded rotation window; comma-separated old 32+ byte secrets.
 GOCHAT_JWT_PREVIOUS_SECRETS=
-GOCHAT_JWT_EXPIRY_HOURS=72
-GOCHAT_JWT_ACCESS_EXPIRY_MINUTES=15
-GOCHAT_JWT_REFRESH_EXPIRY_HOURS=168
+GOCHAT_JWT_ALLOW_INSECURE_HEADER_AUTH=false

-# ---- Logging ----
-GOCHAT_LOG_LEVEL=info  # debug, info, warn, error
-GOCHAT_LOG_FORMAT=json  # json, text
-
-# ---- SMTP / Email ----
-SMTP_ADDRESS=smtp.example.com
-SMTP_PORT=587
-SMTP_USERNAME=your-email@example.com
-SMTP_PASSWORD=your-email-password
-
-# ---- Worker ----
-GOCHAT_WORKER_CONCURRENCY=10
-
-# ---- Frontend URL ----
-FRONTEND_URL=https://your-domain.com
-
-# ---- Search ----
-GOCHAT_SEARCH_ENGINE=meilisearch
-GOCHAT_SEARCH_HOST=http://localhost:7700
-GOCHAT_SEARCH_API_KEY=
-GOCHAT_SEARCH_INDEX_PREFIX=gochat_
-GOCHAT_SEARCH_TIMEOUT_SECONDS=5
-
-# ---- Storage ----
-GOCHAT_STORAGE_PROVIDER=local
-GOCHAT_STORAGE_LOCAL_PATH=./uploads
-GOCHAT_STORAGE_MAX_FILE_SIZE=20971520  # 20MB
-
-# ---- OIDC (Enterprise OAuth/OIDC SSO, disabled by default) ----
-GOCHAT_OIDC_ENABLED=false
-GOCHAT_OIDC_DEFAULT_CLIENT_ID=
-GOCHAT_OIDC_DEFAULT_CLIENT_SECRET=
-GOCHAT_OIDC_DEFAULT_REDIRECT_URL=https://your-domain.com/api/v1/oidc/callback
-GOCHAT_OIDC_DEFAULT_ISSUER_URL=https://accounts.google.com
-GOCHAT_OIDC_DEFAULT_AUTHORIZATION_URL=
-GOCHAT_OIDC_DEFAULT_TOKEN_URL=
-GOCHAT_OIDC_DEFAULT_USER_INFO_URL=
-GOCHAT_OIDC_DEFAULT_JWKS_URL=
-GOCHAT_OIDC_DEFAULT_SCOPES=openid,profile,email
+# Optional connector. Supply the digest published by its release pipeline.
+SHANGWUTONG_IMAGE_REF=ghcr.io/rogeecn/shangwutong@sha256:CHANGE_ME
+GOCHAT_CONNECTOR_SERVICE_TOKEN=