统一 Node 22 与后端安全运行基线（07-15-production-trust-closeout-cleanup）

docker-compose.yml

@@ -6,23 +6,23 @@ services:
     container_name: hyb-oa-db
     restart: always
     environment:
-      POSTGRES_USER: hyboa_user
-      POSTGRES_PASSWORD: hyboa_password
-      POSTGRES_DB: hyb_oa
+      POSTGRES_USER: ${POSTGRES_USER:-hyboa_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in the local environment}
+      POSTGRES_DB: ${POSTGRES_DB:-hyb_oa}
     ports:
       - "5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
 
   server:
-    image: node:20-alpine
+    image: node:22-alpine
     container_name: hyb-oa-server
     restart: unless-stopped
     working_dir: /app/server
     command: sh -c "npm install && npm run dev"
     environment:
-      DATABASE_URL: "postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa?schema=public"
-      JWT_SECRET: "change_me"
+      DATABASE_URL: "postgresql://${POSTGRES_USER:-hyboa_user}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-hyb_oa}?schema=public"
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in the local environment}
       APP_TIMEZONE: "Asia/Shanghai"
       STORAGE_DIR: "generated/storage"
       SERVE_CLIENT_DIST: "false"