248 lines
13 KiB
Bash
248 lines
13 KiB
Bash
# Copy to .env.production and replace every CHANGE_ME value before deployment.
|
|
|
|
COMPOSE_PROJECT_NAME=yuqei-v2-production
|
|
RELEASE_ID=CHANGE_ME_IMMUTABLE_RC_TAG
|
|
YUQEI_RELEASE_ENVIRONMENT_ID=CHANGE_ME_STABLE_ENVIRONMENT_ID
|
|
YUQEI_RELEASE_ENVIRONMENT_CLASS=production
|
|
YUQEI_RELEASE_HOST_ID=CHANGE_ME_STABLE_HOST_ID
|
|
CONTRACT_API_IMAGE=registry.example.com/yuqei/contract-api@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
CONTRACT_WEB_IMAGE=registry.example.com/yuqei/contract-web@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
AI_PLATFORM_API_IMAGE=registry.example.com/yuqei/ai-platform-api@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
AI_PLATFORM_RELEASE_IMAGE_DIGEST=sha256:CHANGE_ME_64_HEX_DIGEST
|
|
AI_WORKER_IMAGE=registry.example.com/yuqei/ai-worker@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
POSTGRES_IMAGE=pgvector/pgvector@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
POSTGRES_CLIENT_IMAGE=postgres@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
REDIS_IMAGE=redis@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
MINIO_IMAGE=minio/minio@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
MINIO_MC_IMAGE=minio/mc@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
NGINX_IMAGE=nginx@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
BACKUP_UTILITY_IMAGE=alpine@sha256:CHANGE_ME_64_HEX_DIGEST
|
|
|
|
BACKEND_SERVER_NAME=api.contracts.example.com
|
|
BACKEND_PUBLIC_BASE_URL=https://api.contracts.example.com
|
|
BACKEND_TLS_CERT_DIR=/etc/yuqei/tls
|
|
# Pin the exact CA bundle used by preflight and the runtime edge health probe.
|
|
BACKEND_TLS_TRUSTED_CA_FILE=/etc/ssl/certs/ca-certificates.crt
|
|
BACKEND_HTTP_BIND_ADDRESS=0.0.0.0
|
|
BACKEND_HTTP_PORT=80
|
|
BACKEND_HTTPS_BIND_ADDRESS=0.0.0.0
|
|
BACKEND_HTTPS_PORT=443
|
|
|
|
POSTGRES_BIND_ADDRESS=127.0.0.1
|
|
REDIS_BIND_ADDRESS=127.0.0.1
|
|
AI_REDIS_BIND_ADDRESS=127.0.0.1
|
|
MINIO_API_BIND_ADDRESS=127.0.0.1
|
|
MINIO_CONSOLE_BIND_ADDRESS=127.0.0.1
|
|
CONTRACT_API_BIND_ADDRESS=127.0.0.1
|
|
AI_PLATFORM_API_BIND_ADDRESS=127.0.0.1
|
|
CONTRACT_WEB_BIND_ADDRESS=127.0.0.1
|
|
|
|
POSTGRES_VOLUME_NAME=yuqei-v2-production-postgres
|
|
MINIO_VOLUME_NAME=yuqei-v2-production-minio
|
|
CONTRACT_FILES_VOLUME_NAME=yuqei-v2-production-contract-files
|
|
BACKUP_HOST_DIR=/mnt/yuqei-v2-backups
|
|
BACKUP_REQUIRE_SEPARATE_MOUNT=true
|
|
BACKUP_MAX_AGE_HOURS=30
|
|
|
|
# Capacity guardrails are evaluated every minute. A disk enters warning or
|
|
# critical state when either its used-percent ceiling or free-space floor is
|
|
# crossed. /home and BACKUP_HOST_DIR are expected to be separate mounts.
|
|
ROOT_DISK_WARNING_PERCENT=85
|
|
ROOT_DISK_CRITICAL_PERCENT=90
|
|
ROOT_DISK_WARNING_FREE_GIB=20
|
|
ROOT_DISK_CRITICAL_FREE_GIB=10
|
|
HOME_DISK_WARNING_PERCENT=85
|
|
HOME_DISK_CRITICAL_PERCENT=90
|
|
HOME_DISK_WARNING_FREE_GIB=20
|
|
HOME_DISK_CRITICAL_FREE_GIB=10
|
|
BACKUP_DISK_WARNING_PERCENT=85
|
|
BACKUP_DISK_CRITICAL_PERCENT=90
|
|
BACKUP_DISK_WARNING_FREE_GIB=20
|
|
BACKUP_DISK_CRITICAL_FREE_GIB=10
|
|
PRODUCTION_ALERT_WEBHOOK_URL_FILE=/etc/yuqei/monitoring/alert-webhook-url
|
|
|
|
# The file is mounted as /run/secrets/ai_provider_api_key. Configure the default
|
|
# database provider with api_key_secret_ref=file:///run/secrets/ai_provider_api_key.
|
|
AI_PROVIDER_API_KEY_FILE=/etc/yuqei/secrets/ai-provider-api-key
|
|
|
|
POSTGRES_USER=CHANGE_ME
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
POSTGRES_DB=postgres
|
|
PYPI_INDEX_URL=https://pypi.org/simple
|
|
NPM_REGISTRY=https://registry.npmjs.org
|
|
CONTRACT_POSTGRES_DB=yuqei_contract
|
|
AI_PLATFORM_POSTGRES_DB=yuqei_ai
|
|
OPS_POSTGRES_DB=yuqei_ops
|
|
POSTGRES_HOST_PORT=5432
|
|
REDIS_HOST_PORT=6379
|
|
AI_REDIS_HOST_PORT=6380
|
|
MINIO_API_HOST_PORT=9000
|
|
MINIO_CONSOLE_HOST_PORT=9001
|
|
CONTRACT_API_HOST_PORT=8100
|
|
AI_PLATFORM_API_HOST_PORT=8101
|
|
CONTRACT_WEB_HOST_PORT=3000
|
|
MINIO_ROOT_USER=CHANGE_ME
|
|
MINIO_ROOT_PASSWORD=CHANGE_ME
|
|
AI_PLATFORM_OBJECT_STORAGE_BUCKET=ai-platform-uploads
|
|
|
|
CONTRACT_API_ENVIRONMENT=production
|
|
CONTRACT_API_DATABASE_URL=postgresql+psycopg://CHANGE_ME:CHANGE_ME@postgres:5432/yuqei_contract
|
|
CONTRACT_API_DATABASE_AUTO_CREATE=false
|
|
CONTRACT_API_SEED_DEMO_DATA=false
|
|
CONTRACT_API_FILE_STORAGE_DIR=/data/contract-files
|
|
CONTRACT_API_REDIS_URL=redis://redis:6379/0
|
|
CONTRACT_API_AI_PLATFORM_BASE_URL=http://ai-platform-api:8101
|
|
CONTRACT_API_AI_PLATFORM_TIMEOUT_SECONDS=60
|
|
CONTRACT_API_WEB_PROXY_SHARED_SECRET=CHANGE_ME_USE_A_RANDOM_32_BYTE_SECRET
|
|
CONTRACT_API_REQUIRE_WEB_PROXY_AUTH=true
|
|
CONTRACT_API_UVICORN_WORKERS=1
|
|
CONTRACT_API_READ_CACHE_TTL_SECONDS=2
|
|
CONTRACT_API_REVIEW_WORKER_NAME=contract-review-worker-1
|
|
CONTRACT_API_REVIEW_WORKER_POLL_INTERVAL_SECONDS=30
|
|
CONTRACT_API_REVIEW_WORKER_BATCH_LIMIT=5
|
|
CONTRACT_API_IDENTITY_EMAIL_DELIVERY_MODE=disabled
|
|
CONTRACT_API_IDENTITY_SELF_SERVICE_ENABLED=false
|
|
# Keep false until real-provider acceptance, effective policies, SMTP and anti-abuse all pass.
|
|
CONTRACT_API_IDENTITY_CONTROLLED_PILOT_REGISTRATION_ENABLED=false
|
|
CONTRACT_API_IDENTITY_CONTROLLED_PILOT_PROBE_TIMEOUT_SECONDS=3
|
|
CONTRACT_API_IDENTITY_MANUAL_INVITATION_ENABLED=true
|
|
# SMTP settings are retained for a future switch to CONTRACT_API_IDENTITY_EMAIL_DELIVERY_MODE=smtp.
|
|
# Add docker-compose.production.smtp.yml only when SMTP is enabled. It mounts the host file below read-only.
|
|
CONTRACT_API_IDENTITY_SMTP_HOST=smtp.example.com
|
|
CONTRACT_API_IDENTITY_SMTP_PORT=587
|
|
CONTRACT_API_IDENTITY_SMTP_USERNAME=mailer@example.com
|
|
CONTRACT_API_IDENTITY_SMTP_PASSWORD=
|
|
CONTRACT_API_IDENTITY_SMTP_PASSWORD_FILE=/run/secrets/contract_smtp_password
|
|
CONTRACT_API_IDENTITY_SMTP_PASSWORD_FILE_HOST=/etc/yuqei/secrets/contract-smtp-password
|
|
CONTRACT_API_IDENTITY_SMTP_FROM_EMAIL=mailer@example.com
|
|
CONTRACT_API_IDENTITY_SMTP_FROM_NAME=AI 合同平台
|
|
CONTRACT_API_IDENTITY_SMTP_USE_STARTTLS=true
|
|
CONTRACT_API_IDENTITY_SMTP_USE_SSL=false
|
|
# STARTTLS and implicit SSL are mutually exclusive; production rejects plaintext SMTP.
|
|
CONTRACT_API_IDENTITY_SMTP_TIMEOUT_SECONDS=10
|
|
CONTRACT_API_PLAYBOOK_NOTIFICATION_DELIVERY_TIMEOUT_SECONDS=10
|
|
CONTRACT_API_PLAYBOOK_NOTIFICATION_WEBHOOK_SIGNING_SECRET=
|
|
CONTRACT_API_PLAYBOOK_NOTIFICATION_WEBHOOK_SIGNING_SECRET_FILE=/run/secrets/playbook_webhook_signing_secret
|
|
CONTRACT_API_PLAYBOOK_NOTIFICATION_WEBHOOK_SIGNING_SECRET_FILE_HOST=/etc/yuqei/secrets/playbook-webhook-signing-secret
|
|
CONTRACT_API_IDENTITY_PUBLIC_WEB_BASE_URL=https://contracts.example.com
|
|
CONTRACT_API_IDENTITY_RATE_LIMIT_SECRET=CHANGE_ME_USE_A_RANDOM_32_BYTE_SECRET
|
|
CONTRACT_API_IDENTITY_CHALLENGE_RESEND_COOLDOWN_SECONDS=60
|
|
CONTRACT_API_IDENTITY_CHALLENGE_RATE_WINDOW_SECONDS=3600
|
|
CONTRACT_API_IDENTITY_CHALLENGE_EMAIL_LIMIT=5
|
|
CONTRACT_API_IDENTITY_CHALLENGE_IP_LIMIT=20
|
|
CONTRACT_API_IDENTITY_CHALLENGE_TENANT_LIMIT=100
|
|
CONTRACT_API_IDENTITY_LOGIN_RATE_WINDOW_SECONDS=900
|
|
CONTRACT_API_IDENTITY_LOGIN_EMAIL_LIMIT=10
|
|
CONTRACT_API_IDENTITY_LOGIN_IP_LIMIT=50
|
|
CONTRACT_API_IDENTITY_ANTI_ENUMERATION_FLOOR_MS=120
|
|
CONTRACT_API_IDENTITY_ANTI_ENUMERATION_JITTER_MS=30
|
|
CONTRACT_API_ANTI_ABUSE_MODE=enforce
|
|
CONTRACT_API_ANTI_ABUSE_HASH_SECRET=CHANGE_ME_USE_A_DIFFERENT_RANDOM_32_BYTE_SECRET
|
|
CONTRACT_API_ANTI_ABUSE_S3_RECORDS_DAILY_LIMIT=1000
|
|
CONTRACT_API_ANTI_ABUSE_S4_RECORDS_DAILY_LIMIT=1000
|
|
CONTRACT_API_ANTI_ABUSE_FILES_DAILY_LIMIT=50
|
|
CONTRACT_API_ANTI_ABUSE_BYTES_DAILY_LIMIT=524288000
|
|
CONTRACT_API_BATCH_DOWNLOAD_MAX_FILES=20
|
|
CONTRACT_API_BATCH_DOWNLOAD_MAX_BYTES=104857600
|
|
|
|
# Enterprise dual-cloud evidence trust is a paid optional capability. Keep it
|
|
# disabled for the core product release; a dedicated UAT overlay sets required.
|
|
CONTRACT_API_RELIABLE_EVIDENCE_EXTERNAL_TRUST_MODE=disabled
|
|
|
|
# P1-04.9.2 cloud KMS gateway. Select exactly one production overlay:
|
|
# docker-compose.production.kms-aliyun.yml or docker-compose.production.kms-tencent.yml.
|
|
KMS_GATEWAY_IMAGE=registry.example.com/yuqei/kms-gateway@sha256:CHANGE_ME
|
|
KMS_GATEWAY_ALLOWED_KEY_IDS=CHANGE_ME_PRIMARY_KEY_ID
|
|
KMS_GATEWAY_PRIMARY_KEY_ID=CHANGE_ME_PRIMARY_KEY_ID
|
|
# Use a dedicated asymmetric key; do not reuse the credential-encryption key.
|
|
KMS_GATEWAY_ALLOWED_SIGNING_KEY_IDS=CHANGE_ME_SIGNING_KEY_ID
|
|
KMS_GATEWAY_SIGNING_KEY_ID=CHANGE_ME_SIGNING_KEY_ID
|
|
KMS_GATEWAY_SIGNING_KEY_VERSION=CHANGE_ME_IMMUTABLE_KEY_VERSION
|
|
KMS_GATEWAY_SIGNING_ALGORITHM=RSA_PSS_SHA_256
|
|
KMS_GATEWAY_SIGNING_ISSUER=AI Contract Platform
|
|
KMS_GATEWAY_TIMEOUT_SECONDS=5
|
|
KMS_GATEWAY_SERVICE_TOKEN_FILE_HOST=/etc/yuqei/secrets/kms-gateway-service-token
|
|
KMS_GATEWAY_LEGACY_RECOVERY_KEY_FILE_HOST=/etc/yuqei/secrets/calendar-legacy-recovery-key
|
|
KMS_GATEWAY_TLS_CERT_FILE_HOST=/etc/yuqei/kms-gateway/tls.crt
|
|
KMS_GATEWAY_TLS_KEY_FILE_HOST=/etc/yuqei/kms-gateway/tls.key
|
|
KMS_GATEWAY_CA_FILE_HOST=/etc/yuqei/kms-gateway/ca.pem
|
|
# Alibaba Cloud KMS instance private endpoint and AAP ClientKey material.
|
|
ALIYUN_KMS_ENDPOINT=kst-CHANGE_ME.cryptoservice.kms.aliyuncs.com
|
|
ALIYUN_KMS_CLIENT_KEY_FILE_HOST=/etc/yuqei/kms-gateway/aliyun-client-key.json
|
|
ALIYUN_KMS_CLIENT_KEY_PASSWORD_FILE_HOST=/etc/yuqei/secrets/aliyun-kms-client-key-password
|
|
ALIYUN_KMS_CA_FILE_HOST=/etc/yuqei/kms-gateway/aliyun-ca.pem
|
|
# Tencent Cloud credential JSON contains secret_id, secret_key and optional token.
|
|
TENCENT_KMS_REGION=ap-guangzhou
|
|
TENCENT_KMS_ENDPOINT=kms.tencentcloudapi.com
|
|
TENCENT_KMS_CREDENTIAL_FILE_HOST=/etc/yuqei/secrets/tencent-kms-credential.json
|
|
|
|
# Verified public-policy material is mounted read-only. The activation executor
|
|
# remains false; promotion is performed only through the named operations CLI.
|
|
PUBLIC_POLICY_CANDIDATE_DIR_HOST=/etc/yuqei/public-policy/2026-08-12
|
|
PUBLIC_POLICY_LEGAL_APPROVAL_FILE_HOST=/etc/yuqei/public-policy/2026-08-12/named-policy-legal-approval.json
|
|
PUBLIC_POLICY_TRUSTED_KEYRING_FILE_HOST=/etc/yuqei/public-policy/2026-08-12/policy-legal-keyring.trusted.json
|
|
CONTRACT_API_PUBLIC_POLICY_RELEASE_DIGEST=sha256:CHANGE_ME_64_HEX_DIGEST
|
|
CONTRACT_API_PUBLIC_POLICY_EXECUTOR_ENABLED=false
|
|
CONTRACT_API_PUBLIC_POLICY_REGISTRATION_FAIL_CLOSED=true
|
|
CONTRACT_REVIEW_WORKER_SEED_DEMO_DATA=false
|
|
CONTRACT_WEB_SESSION_SECRET=CHANGE_ME_USE_A_DIFFERENT_RANDOM_32_BYTE_SECRET
|
|
CONTRACT_WEB_SESSION_SECURE=true
|
|
AI_PLATFORM_SERVICE_SHARED_SECRET=CHANGE_ME_USE_A_THIRD_RANDOM_32_BYTE_SECRET
|
|
# Legacy legal HMAC is staging-fixture-only and must remain empty in production.
|
|
AI_PLATFORM_PROVIDER_LEGAL_ATTESTATION_SECRET=
|
|
# Named legal approval keyrings/evidence allowlists are staging-only and must not be present in production.
|
|
AI_PLATFORM_PROVIDER_LEGAL_APPROVAL_TRUSTED_KEYS_FILE=
|
|
AI_PLATFORM_PROVIDER_LEGAL_EVIDENCE_ALLOWED_HOSTS=
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_RECEIPT_FILE_HOST=/etc/yuqei/provider-acceptance/receipt.json
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_TRUSTED_KEYS_FILE_HOST=/etc/yuqei/provider-acceptance/trusted-keys.json
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_EXPECTED_RECEIPT_SHA256=CHANGE_ME_TO_THE_LOWERCASE_RECEIPT_SHA256
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_RECEIPT_MAX_TTL_SECONDS=604800
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_RECEIPT_CLOCK_SKEW_SECONDS=300
|
|
# Emergency fail-closed control. Set true to block Provider promotion on every node.
|
|
AI_PLATFORM_PROVIDER_ACCEPTANCE_KILL_SWITCH=false
|
|
AI_PLATFORM_REQUIRE_SERVICE_AUTH=true
|
|
|
|
AI_PLATFORM_ENVIRONMENT=production
|
|
AI_PLATFORM_DATABASE_URL=postgresql+psycopg://CHANGE_ME:CHANGE_ME@postgres:5432/yuqei_ai
|
|
AI_PLATFORM_DATABASE_AUTO_CREATE=false
|
|
AI_PLATFORM_REPOSITORY_BACKEND=sqlalchemy
|
|
AI_PLATFORM_REDIS_URL=redis://ai-redis:6379/0
|
|
AI_PLATFORM_PROVIDER_CONFIG_SOURCE=database
|
|
# `enabled` activates the configured OpenAI-compatible provider. `disabled` is smoke-only.
|
|
AI_PLATFORM_PROVIDER_CALL_MODE=enabled
|
|
AI_PLATFORM_PROVIDER_FALLBACK_ENABLED=false
|
|
AI_PLATFORM_MODEL_JOB_DISPATCH_MODE=worker
|
|
AI_PLATFORM_MODEL_JOB_MAX_ATTEMPTS=3
|
|
YUQEI_WORKER_MODEL_JOBS_ENABLED=true
|
|
YUQEI_WORKER_MODEL_JOB_BATCH_LIMIT=2
|
|
YUQEI_WORKER_MODEL_JOB_LEASE_TIMEOUT_SECONDS=600
|
|
AI_PLATFORM_PROVIDER_WIRE_API=responses
|
|
AI_PLATFORM_PROVIDER_REQUEST_TIMEOUT_SECONDS=30
|
|
# Required before generative-AI disclosure can report ready. Do not use placeholders in production.
|
|
AI_PLATFORM_GENERATIVE_AI_FILING_NUMBER=CHANGE_ME_TO_OFFICIAL_FILING_NUMBER
|
|
AI_PLATFORM_GENERATIVE_AI_SERVICE_REGISTRATION_NUMBER=CHANGE_ME_TO_OFFICIAL_REGISTRATION_NUMBER
|
|
AI_PLATFORM_GENERATIVE_AI_SERVICE_PROVIDER_CODE=CHANGE_ME_TO_OFFICIAL_PROVIDER_CODE
|
|
AI_PLATFORM_GENERATIVE_AI_OPERATOR_NAME=内蒙古钰麒科技有限公司
|
|
AI_PLATFORM_GENERATIVE_AI_SUPPORT_EMAIL=admin@yuqei.com
|
|
AI_PLATFORM_GENERATIVE_AI_CONTENT_LABEL=AI生成/辅助内容，请人工复核
|
|
# Set true only after exported files have passed explicit/implicit label inspection.
|
|
AI_PLATFORM_GENERATIVE_AI_IMPLICIT_LABELING_ENABLED=false
|
|
AI_PLATFORM_GENERATIVE_AI_LOG_RETENTION_DAYS=180
|
|
AI_PLATFORM_UVICORN_WORKERS=1
|
|
AI_PLATFORM_ANTI_ABUSE_MODE=enforce
|
|
AI_PLATFORM_ANTI_ABUSE_HASH_SECRET=CHANGE_ME_USE_A_FOURTH_RANDOM_32_BYTE_SECRET
|
|
AI_PLATFORM_ANTI_ABUSE_S3_RECORDS_DAILY_LIMIT=1000
|
|
AI_PLATFORM_ANTI_ABUSE_S4_RECORDS_DAILY_LIMIT=1000
|
|
AI_PLATFORM_ANTI_ABUSE_FILES_DAILY_LIMIT=50
|
|
AI_PLATFORM_ANTI_ABUSE_BYTES_DAILY_LIMIT=524288000
|
|
|
|
YUQEI_WORKER_ENVIRONMENT=production
|
|
YUQEI_WORKER_DATABASE_URL=postgresql+psycopg://CHANGE_ME:CHANGE_ME@postgres:5432/yuqei_ai
|
|
YUQEI_WORKER_DATABASE_AUTO_CREATE=false
|
|
YUQEI_WORKER_REDIS_URL=redis://ai-redis:6379/1
|
|
YUQEI_WORKER_TENANT_ID=default
|
|
YUQEI_WORKER_TRACE_GOVERNANCE_ENABLED=false
|
|
YUQEI_WORKER_TRACE_GOVERNANCE_INTERVAL_SECONDS=300
|
|
YUQEI_WORKER_TRACE_GOVERNANCE_BATCH_LIMIT=100
|
|
YUQEI_WORKER_TRACE_GOVERNANCE_WORKER_NAME=trace-governance-worker
|