157 行
5.4 KiB
Bash
157 行
5.4 KiB
Bash
DATABASE_URL="<local-postgresql-url>"
|
||
# seed:dev 默认拒绝执行；仅本机开发库可显式开启，并确认 URL 中的数据库名。
|
||
# SEED_DEV_ALLOW="1"
|
||
# SEED_DEV_DATABASE_CONFIRM="hyb_oa"
|
||
# 仅需主动轮换已有开发账号时开启；轮换后账号必须首次登录改密。
|
||
# SEED_DEV_RESET_PASSWORDS="0"
|
||
JWT_SECRET="<generate-a-local-secret>"
|
||
AUTH_CODE_PEPPER="<generate-a-separate-random-secret>"
|
||
# ===== 敏感字段加密（F25）=====
|
||
# 用于员工银行卡/身份证等字段的可逆加密（AES-256-GCM）。
|
||
# 生成方式示例：openssl rand -base64 32
|
||
# FIELD_ENCRYPTION_KEY=""
|
||
# APP_ORIGIN="https://oa.hyinda.com"
|
||
# COOKIE_SECURE="true"
|
||
# TRUST_PROXY_HOPS="0" # 本机开发默认不信任 X-Forwarded-For；受控单跳反代使用 1
|
||
# PASSWORD_RESET_CODE_TTL_SECONDS="600"
|
||
# PASSWORD_RESET_FAIL_WINDOW_SECONDS="1800"
|
||
# PASSWORD_RESET_MAX_ATTEMPTS="5"
|
||
# PASSWORD_RESET_LOCK_SECONDS="1800"
|
||
# PASSWORD_RESET_REQUEST_WINDOW_SECONDS="3600"
|
||
# PASSWORD_RESET_REQUEST_MAX="3"
|
||
# AUTH_CODE_REQUEST_COOLDOWN_SECONDS="60"
|
||
# EMAIL_LOGIN_CODE_TTL_SECONDS="600"
|
||
# EMAIL_LOGIN_CODE_MAX_ATTEMPTS="5"
|
||
# EMAIL_LOGIN_CODE_FAIL_WINDOW_SECONDS="1800"
|
||
# EMAIL_LOGIN_CODE_LOCK_SECONDS="1800"
|
||
# DEV_SHOW_PASSWORD_RESET_CODE="false"
|
||
APP_TIMEZONE="Asia/Shanghai"
|
||
STORAGE_DIR="generated/storage"
|
||
# STORAGE_DRIVER="local" # local|s3（MinIO/S3 兼容）
|
||
# S3_ENDPOINT="" # 例如：http://127.0.0.1:9000（MinIO）
|
||
# S3_REGION="us-east-1"
|
||
# S3_BUCKET="hyb-oa"
|
||
# S3_ACCESS_KEY_ID=""
|
||
# S3_SECRET_ACCESS_KEY=""
|
||
# S3_FORCE_PATH_STYLE="true" # MinIO 建议 true
|
||
SIGNED_URL_TTL_SECONDS="600"
|
||
MAX_UPLOAD_SIZE_BYTES="10485760"
|
||
|
||
# ===== Metrics（Prometheus & OpenTelemetry）=====
|
||
# METRICS_ENABLED="true"
|
||
# OTEL_TRACES_ENABLED="false"
|
||
|
||
# ===== 单域托管 client/dist（试运行/生产建议）=====
|
||
# SERVE_CLIENT_DIST="true"
|
||
# CLIENT_DIST_DIR="../client/dist"
|
||
# OpenAPI 文档端点（建议仅非生产开启）
|
||
# OPENAPI_DOCS_ENABLED="false"
|
||
|
||
# ===== 安全基线（默认：production=true，其它环境=false，可显式覆盖）=====
|
||
# RATE_LIMIT_ENABLED="true"
|
||
# RATE_LIMIT_LOGIN_MAX="10"
|
||
# RATE_LIMIT_LOGIN_WINDOW="1 minute"
|
||
|
||
# ===== 登录安全（失败锁定/弱密码拦截）=====
|
||
# AUTH_LOGIN_FAIL_WINDOW_SECONDS="900" # 15min
|
||
# AUTH_LOGIN_FAIL_MAX_ATTEMPTS="5"
|
||
# AUTH_LOGIN_LOCK_SECONDS="1800" # 30min
|
||
# WEAK_PASSWORD_CHECK_ENABLED="true"
|
||
# WEAK_PASSWORD_MIN_SCORE="2" # zxcvbn score < 2 -> reject
|
||
|
||
# ===== OIDC/SSO（F23，可选）=====
|
||
# OIDC_ENABLED="true"
|
||
# OIDC_ISSUER_URL=""
|
||
# OIDC_CLIENT_ID=""
|
||
# OIDC_CLIENT_SECRET=""
|
||
# OIDC_REDIRECT_URI="http://127.0.0.1:3000/api/auth/oidc/callback"
|
||
# OIDC_SCOPES="openid profile email"
|
||
|
||
# ===== 企业微信（入口/打卡同步，可选）=====
|
||
# WECOM_ENABLED="false"
|
||
# WECOM_ENTRY_ENABLED="false"
|
||
# WECOM_PC_WEB_LOGIN_ENABLED="false"
|
||
# WECOM_OAUTH_ENABLED="false"
|
||
# WECOM_OAUTH_ONBOARDING_ENABLED="false"
|
||
# WECOM_CORP_ID=""
|
||
# WECOM_AGENT_ID=""
|
||
# WECOM_AGENT_SECRET=""
|
||
# WECOM_REDIRECT_URI="https://oa.example.com/api/auth/wecom/callback"
|
||
# WECOM_ALLOWED_RETURN_HOSTS="oa.example.com"
|
||
# WECOM_CHECKIN_SYNC_ENABLED="false"
|
||
# WECOM_CHECKIN_SECRET=""
|
||
# WECOM_CONTACT_SYNC_ENABLED="false"
|
||
# WECOM_CONTACT_SECRET=""
|
||
# WECOM_CONTACT_DEFAULT_DEPARTMENT_ID=""
|
||
|
||
DELEGATION_REVOKE_CRON="0 * * * *"
|
||
|
||
OCR_PROVIDER="off"
|
||
# OCR_CRON_ENABLED="false" # 仅关闭后台 OCR 定时任务；保留 OCR API/手工重试能力
|
||
OCR_BATCH_SIZE="10"
|
||
OCR_LOCK_TTL_SECONDS="300"
|
||
OCR_POLL_CRON="* * * * *"
|
||
OCR_MAX_ATTEMPTS="3"
|
||
OCR_TIMEOUT_MS="5000"
|
||
|
||
# ===== 发票验真（P6）=====
|
||
INVOICE_VERIFICATION_ENABLED="false"
|
||
# INVOICE_VERIFICATION_ENABLED 作为Env硬闸；在线灰度由 /api/system/feature-flags 管理
|
||
|
||
# ===== 请假日历增强（P16B）=====
|
||
LEAVE_HOLIDAY_CALENDAR_ENABLED="false"
|
||
# LEAVE_HOLIDAY_CALENDAR_ENABLED 作为Env硬闸；在线灰度由 /api/system/feature-flags 管理
|
||
VERIFICATION_PROVIDER="mock" # mock|tax
|
||
VERIFICATION_POLL_CRON="* * * * *"
|
||
VERIFICATION_MAX_ATTEMPTS="3"
|
||
VERIFICATION_RETRY_COOLDOWN_SECONDS="60"
|
||
VERIFICATION_TIMEOUT_MS="5000"
|
||
|
||
INVOICE_ARCHIVE_CRON="30 2 * * *"
|
||
INVOICE_ARCHIVE_UNUSED_DAYS="90"
|
||
INVOICE_ARCHIVE_BATCH_SIZE="200"
|
||
TENCENT_SECRET_ID=""
|
||
TENCENT_SECRET_KEY=""
|
||
TENCENT_OCR_REGION="ap-beijing"
|
||
|
||
# ===== 预算与集成（P7-P8）=====
|
||
BUDGET_CONTROL_MODE="warn" # warn|block
|
||
ERP_SYNC_ENABLED="false"
|
||
# ERP_SYNC_ENABLED 作为Env硬闸；在线灰度由 /api/system/feature-flags 管理
|
||
ERP_SYNC_PROVIDER="mock" # mock|http
|
||
ERP_SYNC_ENDPOINT=""
|
||
ERP_SYNC_TIMEOUT_MS="5000"
|
||
ERP_SYNC_AUTH_TOKEN=""
|
||
TRAVEL_SYNC_ENABLED="false"
|
||
IM_NOTIFIER_ENABLED="false"
|
||
INTEGRATION_OUTBOX_CRON="* * * * *"
|
||
INTEGRATION_OUTBOX_BATCH_SIZE="20"
|
||
INTEGRATION_OUTBOX_MAX_ATTEMPTS="5"
|
||
INTEGRATION_OUTBOX_RETRY_SECONDS="120"
|
||
|
||
# ===== 试运行引导管理员（E20，可选）=====
|
||
# TRIALRUN_ADMIN_EMAIL="<admin-email>"
|
||
# TRIALRUN_ADMIN_PHONE="<admin-phone>"
|
||
# TRIALRUN_ADMIN_PASSWORD=""
|
||
|
||
# R12 lite feature gates
|
||
BUDGET_PRECHECK_ENABLED=false
|
||
PAYMENT_BATCH_ENABLED=false
|
||
PORTAL_HOME_ENABLED=false
|
||
GLOBAL_SEARCH_ENABLED=false
|
||
ANNOUNCEMENTS_ENABLED=false
|
||
WORKFLOW_DEFINITION_ADMIN_ENABLED=false
|
||
CUTOVER_CONSOLE_ENABLED=false
|
||
OIDC_PROVIDER_LABEL=企业统一登录
|
||
|
||
# ===== Prisma Migration Diff（本地生成 migration 用，可选） =====
|
||
# SHADOW_DATABASE_URL="<local-shadow-postgresql-url>"
|
||
|
||
# ===== R13-R17 小团队内部管理 =====
|
||
PRESENCE_BOARD_ENABLED=false
|
||
ATTENDANCE_UNIFIED_ENABLED=false
|
||
WEEKLY_REPORT_ENABLED=false
|
||
EMPLOYEE_LIFECYCLE_ENABLED=false
|
||
WECOM_CONTACT_SYNC_ENABLED=false
|
||
TODO_BOARD_ENABLED=false
|