eb956d0dce
Some checks failed
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
refactor(saas): 重构认证中间件与限流策略
- 登录限流调整为5次/分钟/IP
- 注册限流调整为3次/小时/IP
- GET请求不计入限流
fix(saas): 修复调度器时间戳处理
- 使用NOW()替代文本时间戳
- 兼容TEXT和TIMESTAMPTZ列类型
feat(saas): 实现环境变量插值
- 支持${ENV_VAR}语法解析
- 数据库密码支持环境变量注入
chore: 新增前端管理界面
- 基于React+Ant Design Pro
- 包含路由守卫/错误边界
- 对接58个API端点
docs: 更新安全加固文档
- 新增密钥管理规范
- 记录P0安全项审计结果
- 补充TLS终止说明
test: 完善配置解析单元测试
- 新增环境变量插值测试用例
44 lines
1.5 KiB
Plaintext
44 lines
1.5 KiB
Plaintext
# ZCLAW SaaS 配置示例
|
||
# 复制此文件为 saas-config.toml 并修改配置
|
||
# cp saas-config.toml.example saas-config.toml
|
||
#
|
||
# 安全说明:
|
||
# - 数据库密码支持 ${DB_PASSWORD} 环境变量插值，也可通过 ZCLAW_DATABASE_URL 完整覆盖
|
||
# - JWT 密钥必须通过环境变量 ZCLAW_SAAS_JWT_SECRET 设置（至少 32 字符随机字符串）
|
||
# - TOTP 加密密钥通过环境变量 ZCLAW_TOTP_ENCRYPTION_KEY 设置（64 个十六进制字符）
|
||
# - 生产环境必须设置 ZCLAW_SAAS_JWT_SECRET，否则服务拒绝启动
|
||
# - 开发环境可设置 ZCLAW_SAAS_DEV=true 放宽安全限制（仅限本地开发）
|
||
|
||
[server]
|
||
host = "0.0.0.0"
|
||
port = 8080
|
||
# CORS 允许的源列表; 开发环境使用 localhost, 生产环境改为实际域名
|
||
cors_origins = ["http://localhost:1420", "http://localhost:5173", "http://localhost:3000"]
|
||
|
||
[database]
|
||
# 支持 ${ENV_VAR} 环境变量插值 — 推荐
|
||
url = "postgres://postgres:${DB_PASSWORD}@localhost:5432/zclaw"
|
||
# 或通过 ZCLAW_DATABASE_URL 环境变量完整覆盖（优先级最高）
|
||
|
||
[auth]
|
||
jwt_expiration_hours = 24
|
||
totp_issuer = "ZCLAW SaaS"
|
||
|
||
[relay]
|
||
max_queue_size = 1000
|
||
max_concurrent_per_provider = 5
|
||
batch_window_ms = 50
|
||
retry_delay_ms = 1000
|
||
max_attempts = 3
|
||
|
||
[rate_limit]
|
||
requests_per_minute = 60
|
||
burst = 10
|
||
|
||
[scheduler]
|
||
# 定时任务配置 (可选)
|
||
# jobs = [
|
||
# { name = "cleanup-expired-tokens", interval = "1h", task = "token_cleanup", run_on_start = false },
|
||
# { name = "aggregate-usage-stats", interval = "24h", task = "usage_aggregation", run_on_start = true },
|
||
# ]
|