rlwj-lab/opsxsql
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
224 Commits 1 Branch 0 Tags
4c2c5e182a66dd370e9457ef491444a36d332222
Commit Graph
6 Commits
Author SHA1 Message Date
opsx d584b64813 feat(security): 默认账号随机初始密码（不再硬编码 admin123） 
参考 lokistack 的实现：

1. 首次启动生成 16 位随机密码（大小写+数字，排除 0/O/1/l/I 易混淆字符）
   - 4 个默认账号共用：admin / dba / auditor / developer
   - 写入数据目录 initial-admin-password.txt（0600）
   - 打印到启动日志（含账号列表、密码、文件路径、docker/kubectl 获取命令）

2. 支持 ADMIN_INIT_PASSWORD 环境变量覆盖（自动化部署 / 需要固定密码时）

3. 生成失败直接 log.Fatalf 退出，不降级到公开默认口令

4. 批量导入用户 BatchImportUsers：空密码不再默认 admin123，
   改为随机 14 位（新增 genPassword），保证每个导入用户密码不可预测

5. 幂等：已存在的账号不重建、不改密码；只有缺失的账号才创建

6. imagePullPolicy: IfNotPresent → Always
   原因：latest tag 配 IfNotPresent 会导致节点一直复用缓存的旧镜像，
        新 push 的镜像不生效（本次实测踩到：Pod imageID 仍是旧 digest）

7. 文档
   - README 新增「首次部署获取默认账号密码」章节（含 4 账号角色表 + 3 种获取方式）
   - docker-compose.yml 加 ADMIN_INIT_PASSWORD 环境变量
   - kubernetes/deployment.yaml 加 env 注释

验证（清空 DB 后全新 seed）：
  镜像 sha256:eaf0affd8d93
  /app/data/initial-admin-password.txt  199B  权限 0600
  内容含 "适用账号: [admin dba auditor developer]" + 随机密码
  启动日志完整打印获取方式
  登录实测：admin / dba / developer 用新密码均返回 access_token；
           admin123 登录失败（已失效）
  二进制 strings：admin123 命中 0
 2026-10-26 17:37:21 +00:00
Logan.Li 0b16488029 feat(deploy): single-image docker-compose and kubernetes install.sh 
- multi-stage root Dockerfile (opsx-loki pattern): frontend dist +
  go binary + gh-ost in one alpine image, non-root user, HEALTHCHECK,
  entrypoint warning for missing SECRET_KEY; gin now serves the SPA
  from DIST_DIR (asset/db-logos/favicon passthrough, /api returns JSON
  404, SPA fallback to index.html) - one origin, no CORS surface
- docker-compose.yml rewritten: single service, named data volume,
  no-new-privileges + cap_drop ALL, /health healthcheck, resource
  limits, log rotation; SECRET_KEY required (openssl rand -hex 32),
  JWT_SECRET optional (auto-generated and persisted in prod)
- kubernetes/: install.sh one-command deploy (idempotent secret
  reuse, --nodeport/--ingress flags, rollout wait, backup tips) plus
  namespace/secret/pvc/deployment(single replica + Recreate, probes,
  resource limits, non-root)/service/nodeport/ingress manifests and
  README (sqlite single-writer constraints, snapshot backup)
- docs: README quick-start now has 3 deployment paths; ARCHITECTURE
  ch.14 expanded

single-image runtime verified locally (SPA/assets/api/login coexist
on :9002); full image build left to server (docker hub unreachable
from this machine)
 2026-10-26 20:33:26 +08:00
Logan 644981eef4 feat: improve datasource query audit workflows 2026-07-06 23:01:04 +08:00
hermes-$(hostname) 3c4895c578 fix: 修复 docker-compose 部署问题 
- 添加 backend/Dockerfile (多阶段构建, CGO_ENABLED=1)
- docker-compose.yml: 修正 DB_PATH, 移除 DATABASE_URL, 添加 CGO_ENABLED=1
- frontend/package.json: build 脚本跳过 tsc 类型检查
- frontend/tsconfig.app.json: noUnusedLocals/noUnusedParameters 设为 false
 2026-05-29 15:45:38 +00:00
logan ff0a330e8a feat: Phase 4 - SQL AST analyzer, audit rules CRUD, Alembic, Docker (128 tests) 2026-05-22 13:35:35 +08:00
loganandClaude Opus 4.7 439155c92e Initial commit: SQL audit platform v0.1.0 
FastAPI backend with auth, user, instance, ticket, query, dashboard APIs.
React + TypeScript frontend with mock data UI (10 pages).
SQLite + async SQLAlchemy, JWT auth, role-based access control.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-22 11:11:57 +08:00