224 行
6.8 KiB
Bash
224 行
6.8 KiB
Bash
## hyb-oa 试运行环境变量示例（单机）
|
||
##
|
||
## 说明：
|
||
## - 统一以 deploy/trialrun/.env 作为 trialrun 部署事实源。
|
||
## - 默认使用 env_file 注入 server / worker / init 容器环境。
|
||
## - 推荐使用无引号值；旧的带引号写法当前仍兼容，但建议后续逐步改成无引号。
|
||
## - 普通字符串、布尔值、数字、cron 都可直接写为无引号值。
|
||
##
|
||
## 使用方式：
|
||
## cp deploy/trialrun/.env.example deploy/trialrun/.env
|
||
## 然后按需修改 deploy/trialrun/.env 中的值（不要提交 .env）
|
||
##
|
||
## 同机公网部署建议：
|
||
## - 官网继续使用 hyinda.com / www.hyinda.com
|
||
## - OA 单独使用 oa.example.com 一类二级域名
|
||
## - 正式公网环境请保持 APP_ORIGIN=https://oa.example.com
|
||
## - 正式公网环境请保持 COOKIE_SECURE=true
|
||
##
|
||
|
||
# ===== 运行模式与基础域名 =====
|
||
NODE_ENV=production
|
||
APP_ORIGIN=https://oa.example.com
|
||
APP_TIMEZONE=Asia/Shanghai
|
||
REIMBURSEMENT_MAX_AGE_DAYS=365
|
||
HOST=0.0.0.0
|
||
PORT=3000
|
||
# 宿主机回环端口；容器内仍固定监听 PORT，Caddy 必须指向此端口。
|
||
APP_HOST_PORT=3000
|
||
TRUST_PROXY_HOPS=1
|
||
COOKIE_SECURE=true
|
||
OPENAPI_DOCS_ENABLED=false
|
||
SERVE_CLIENT_DIST=true
|
||
CLIENT_DIST_DIR=../client/dist
|
||
SIGNED_URL_TTL_SECONDS=600
|
||
MAX_UPLOAD_SIZE_BYTES=10485760
|
||
|
||
# ===== 服务端密钥（必须修改） =====
|
||
JWT_SECRET=<managed-jwt-secret>
|
||
AUTH_CODE_PEPPER=<managed-auth-code-pepper>
|
||
FIELD_ENCRYPTION_KEY=
|
||
|
||
# ===== 密码 / 登录安全 =====
|
||
PASSWORD_RESET_CODE_TTL_SECONDS=600
|
||
PASSWORD_RESET_FAIL_WINDOW_SECONDS=1800
|
||
PASSWORD_RESET_MAX_ATTEMPTS=5
|
||
PASSWORD_RESET_LOCK_SECONDS=1800
|
||
PASSWORD_RESET_REQUEST_WINDOW_SECONDS=3600
|
||
PASSWORD_RESET_REQUEST_MAX=3
|
||
AUTH_CODE_REQUEST_COOLDOWN_SECONDS=60
|
||
DEV_SHOW_PASSWORD_RESET_CODE=false
|
||
EMAIL_LOGIN_CODE_TTL_SECONDS=600
|
||
EMAIL_LOGIN_CODE_MAX_ATTEMPTS=5
|
||
EMAIL_LOGIN_CODE_FAIL_WINDOW_SECONDS=1800
|
||
EMAIL_LOGIN_CODE_LOCK_SECONDS=1800
|
||
AUTH_LOGIN_FAIL_WINDOW_SECONDS=900
|
||
AUTH_LOGIN_FAIL_MAX_ATTEMPTS=5
|
||
AUTH_LOGIN_LOCK_SECONDS=1800
|
||
RATE_LIMIT_ENABLED=true
|
||
RATE_LIMIT_LOGIN_MAX=10
|
||
RATE_LIMIT_LOGIN_WINDOW=1 minute
|
||
PUBLIC_SECURITY_HARDENING_ENABLED=true
|
||
|
||
# ===== 可观测性 =====
|
||
METRICS_ENABLED=true
|
||
OTEL_TRACES_ENABLED=false
|
||
|
||
# ===== OIDC / SSO（可选） =====
|
||
OIDC_ENABLED=false
|
||
OIDC_ISSUER_URL=
|
||
OIDC_CLIENT_ID=
|
||
OIDC_CLIENT_SECRET=
|
||
OIDC_REDIRECT_URI=https://oa.example.com/api/auth/oidc/callback
|
||
OIDC_SCOPES=openid profile email
|
||
|
||
# ===== 企业微信入口 / OAuth（可选） =====
|
||
WECOM_ENABLED=false
|
||
WECOM_ENTRY_ENABLED=false
|
||
WECOM_PC_WEB_LOGIN_ENABLED=false
|
||
WECOM_CORP_ID=
|
||
WECOM_AGENT_ID=
|
||
WECOM_AGENT_SECRET=
|
||
WECOM_OAUTH_ENABLED=false
|
||
WECOM_OAUTH_ONBOARDING_ENABLED=false
|
||
WECOM_REDIRECT_URI=https://oa.example.com/api/auth/wecom/callback
|
||
WECOM_ALLOWED_RETURN_HOSTS=oa.example.com
|
||
WECOM_CHECKIN_SYNC_ENABLED=false
|
||
# 企业微信打卡同步 Secret：显式配置优先；留空时复用已授权调用打卡 API 的 WECOM_AGENT_SECRET
|
||
WECOM_CHECKIN_SECRET=
|
||
WECOM_CONTACT_SYNC_ENABLED=false
|
||
WECOM_CONTACT_SECRET=
|
||
WECOM_CONTACT_DEFAULT_DEPARTMENT_ID=
|
||
WECOM_HR_MASTER_SYNC_ENABLED=false
|
||
# 企业微信 HR 主数据镜像 Secret：人事助手专用 Secret 优先；留空时仅可复用已验证授权应用的 WECOM_AGENT_SECRET
|
||
WECOM_HR_ASSISTANT_SECRET=
|
||
# 企业微信审批回调 POC：真实值只配置在部署环境，不写入仓库、Issue 或聊天
|
||
WECOM_APPROVAL_CALLBACK_URL=https://oa.example.com/api/wecom/approval/callback
|
||
WECOM_CALLBACK_TOKEN=
|
||
WECOM_CALLBACK_ENCODING_AES_KEY=
|
||
WECOM_APPROVAL_CALLBACK_EVIDENCE_FILE=
|
||
IM_NOTIFIER_ENABLED=true
|
||
|
||
# ===== 数据库（Compose 内部连接） =====
|
||
# Compose 项目名由 deploy/timer 命令通过 -p 显式传入，不写入本文件。
|
||
# 以下相对目录仅供本地直接 Compose；正式 deploy.sh 必须另行显式传入绝对路径和 DEPLOY_DATA_MODE。
|
||
POSTGRES_DATA_DIR=./data/postgres
|
||
POSTGRES_DB=<managed-db-name>
|
||
POSTGRES_USER=<managed-db-user>
|
||
POSTGRES_PASSWORD=<managed-db-password>
|
||
DATABASE_URL=<managed-postgresql-url>
|
||
# SHADOW_DATABASE_URL=<managed-shadow-postgresql-url>
|
||
|
||
# ===== 存储与上传 =====
|
||
STORAGE_HOST_DIR=./data/storage
|
||
STORAGE_DIR=/data/storage
|
||
STORAGE_DRIVER=local
|
||
S3_ENDPOINT=http://minio:9000
|
||
S3_REGION=us-east-1
|
||
S3_BUCKET=hyb-oa
|
||
S3_ACCESS_KEY_ID=<managed-s3-access-key>
|
||
S3_SECRET_ACCESS_KEY=<managed-s3-secret>
|
||
S3_FORCE_PATH_STYLE=true
|
||
MINIO_ROOT_USER=<managed-minio-user>
|
||
MINIO_ROOT_PASSWORD=<managed-minio-password>
|
||
|
||
# ===== OCR（off | mock | tencent） =====
|
||
OCR_PROVIDER=mock
|
||
OCR_CRON_ENABLED=true
|
||
OCR_MAX_ATTEMPTS=3
|
||
OCR_POLL_CRON=*/5 * * * * *
|
||
OCR_BATCH_SIZE=10
|
||
OCR_LOCK_TTL_SECONDS=300
|
||
OCR_TIMEOUT_MS=5000
|
||
TENCENT_SECRET_ID=
|
||
TENCENT_SECRET_KEY=
|
||
TENCENT_OCR_REGION=ap-beijing
|
||
|
||
# ===== 验真 / 发票 / 节假日 =====
|
||
INVOICE_VERIFICATION_ENABLED=false
|
||
LEAVE_HOLIDAY_CALENDAR_ENABLED=true
|
||
VERIFICATION_PROVIDER=mock
|
||
VERIFICATION_POLL_CRON=* * * * *
|
||
VERIFICATION_MAX_ATTEMPTS=3
|
||
VERIFICATION_RETRY_COOLDOWN_SECONDS=60
|
||
VERIFICATION_TIMEOUT_MS=5000
|
||
INVOICE_ARCHIVE_CRON=30 2 * * *
|
||
INVOICE_ARCHIVE_UNUSED_DAYS=90
|
||
INVOICE_ARCHIVE_BATCH_SIZE=200
|
||
|
||
# ===== 预算 / 费控 =====
|
||
BUDGET_CONTROL_MODE=warn
|
||
BUDGET_PRECHECK_ENABLED=false
|
||
PAYMENT_BATCH_ENABLED=true
|
||
|
||
# ===== 周边集成 / ERP =====
|
||
ERP_SYNC_ENABLED=false
|
||
ERP_SYNC_PROVIDER=mock
|
||
ERP_SYNC_ENDPOINT=
|
||
ERP_SYNC_TIMEOUT_MS=5000
|
||
ERP_SYNC_AUTH_TOKEN=
|
||
ERP_JOURNAL_EXPORT_ENDPOINT=
|
||
ERP_PROCUREMENT_EXPORT_ENDPOINT=
|
||
ERP_ASSET_EXPORT_ENDPOINT=
|
||
ERP_MASTER_DATA_ENDPOINT=
|
||
ERP_PROCUREMENT_TIMEOUT_MS=5000
|
||
ERP_ASSET_TIMEOUT_MS=5000
|
||
ERP_MASTER_DATA_TIMEOUT_MS=5000
|
||
ERP_MASTER_DATA_SYNC_CRON=
|
||
TRAVEL_SYNC_ENABLED=false
|
||
INTEGRATION_OUTBOX_CRON=* * * * *
|
||
INTEGRATION_OUTBOX_BATCH_SIZE=20
|
||
INTEGRATION_OUTBOX_MAX_ATTEMPTS=5
|
||
INTEGRATION_OUTBOX_RETRY_SECONDS=120
|
||
|
||
# ===== 邮件 =====
|
||
EMAIL_ENABLED=false
|
||
EMAIL_FROM=<sender-email>
|
||
EMAIL_BASE_URL=https://oa.example.com
|
||
SMTP_HOST=
|
||
SMTP_PORT=587
|
||
SMTP_SECURE=false
|
||
SMTP_USER=
|
||
SMTP_PASS=
|
||
|
||
# ===== 委派 / 作业 =====
|
||
DELEGATION_REVOKE_CRON=0 * * * *
|
||
JOB_DRIVER=pgboss
|
||
JOBS_ENABLED=true
|
||
PG_BOSS_SCHEMA=pgboss
|
||
|
||
# ===== AI（默认关闭） =====
|
||
AI_ASSIST_ENABLED=false
|
||
AI_PROVIDER=mock
|
||
AI_BASE_URL=
|
||
AI_MODEL=
|
||
AI_TIMEOUT_MS=10000
|
||
AI_AUTH_TOKEN=
|
||
|
||
# ===== Trialrun 初始化管理员 =====
|
||
TRIALRUN_ADMIN_EMAIL=<admin-email>
|
||
TRIALRUN_ADMIN_PHONE=<admin-phone>
|
||
TRIALRUN_ADMIN_PASSWORD=
|
||
TRIALRUN_ADMIN_EMPLOYEE_NO=<admin-employee-no>
|
||
TRIALRUN_ADMIN_NAME=Trialrun Admin
|
||
TRIALRUN_ADMIN_TITLE=系统管理员
|
||
TRIALRUN_ADMIN_HIRE_DATE=2020-01-01
|
||
|
||
# ===== 功能开关环境闸门（trialrun 推荐） =====
|
||
PORTAL_HOME_ENABLED=true
|
||
GLOBAL_SEARCH_ENABLED=true
|
||
ANNOUNCEMENTS_ENABLED=true
|
||
PRESENCE_BOARD_ENABLED=true
|
||
ATTENDANCE_ENABLED=false
|
||
ATTENDANCE_UNIFIED_ENABLED=true
|
||
WEEKLY_REPORT_ENABLED=true
|
||
EMPLOYEE_LIFECYCLE_ENABLED=true
|
||
TODO_BOARD_ENABLED=true
|
||
WORKFLOW_DEFINITION_ADMIN_ENABLED=false
|
||
CUTOVER_CONSOLE_ENABLED=false
|
||
PROJECT_DOMAIN_ENABLED=true
|
||
PROJECT_LINKING_ENABLED=true
|
||
PROJECT_COMMUNICATION_LOG_ENABLED=true
|
||
PROJECT_CLOSURE_CHECKLIST_ENABLED=true
|
||
CONFIDENTIAL_DOC_REFS_ENABLED=true
|