From 368dc0abf0e95f66c33818951c1d678cf84c0feb Mon Sep 17 00:00:00 2001 From: xiangning Date: Thu, 9 Jul 2026 12:52:01 +0800 Subject: [PATCH] =?UTF-8?q?security:=20=E6=95=8F=E6=84=9F=E9=85=8D?= =?UTF-8?q?=E7=BD=AE=E8=BF=81=E7=A7=BB=E8=87=B3=20appsettings.Secrets.json?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - appsettings.json 敏感项（连接串/密钥/API Key）改为占位符 - 新增 appsettings.Secrets.json（本地，gitignore）+ .example.json（模板） - Program.cs 与 3 个 design-time factory 加载 Secrets.json 覆盖 - 历史中的明文凭据已用 git filter-repo 清理（REDACTED） --- .gitignore | 1 + src/BuildFlow.Host/Program.cs | 4 ++++ .../appsettings.Secrets.example.json | 23 +++++++++++++++++++ src/BuildFlow.Host/appsettings.json | 20 ++++++++-------- .../FileDbContextDesignTimeFactory.cs | 1 + .../ImDbContextDesignTimeFactory.cs | 1 + .../RagDbContextDesignTimeFactory.cs | 1 + 7 files changed, 41 insertions(+), 10 deletions(-) create mode 100644 src/BuildFlow.Host/appsettings.Secrets.example.json diff --git a/.gitignore b/.gitignore index 632750f..0dfebae 100644 --- a/.gitignore +++ b/.gitignore @@ -21,6 +21,7 @@ !.env.example **/appsettings.Development.json **/appsettings.Production.json +**/appsettings.Secrets.json **/secrets.json # ===== 前端 ===== diff --git a/src/BuildFlow.Host/Program.cs b/src/BuildFlow.Host/Program.cs index 0078d4a..82d055e 100644 --- a/src/BuildFlow.Host/Program.cs +++ b/src/BuildFlow.Host/Program.cs @@ -4,6 +4,10 @@ using OpenTelemetry.Logs; var builder = WebApplication.CreateBuilder(args); +// 敏感配置（连接串/密钥）从本地 appsettings.Secrets.json 覆盖，该文件不入库（见 .gitignore）。 +// 不存在时 optional:true 静默跳过，回退到 appsettings.json 中的占位符。 +builder.Configuration.AddJsonFile("appsettings.Secrets.json", optional: true, reloadOnChange: true); + // OTel 日志导出 var otlpEndpoint = builder.Configuration["OpenTelemetry:OtlpEndpoint"] ?? "http://localhost:4316"; builder.Logging.AddOpenTelemetry(logging => diff --git a/src/BuildFlow.Host/appsettings.Secrets.example.json b/src/BuildFlow.Host/appsettings.Secrets.example.json new file mode 100644 index 0000000..4261a08 --- /dev/null +++ b/src/BuildFlow.Host/appsettings.Secrets.example.json @@ -0,0 +1,23 @@ +{ + "ConnectionStrings": { + "Default": "Host=YOUR_HOST;Port=15432;Username=rag;Password=YOUR_PG_PASSWORD", + "MongoDb": "mongodb://appuser:YOUR_MONGO_PASSWORD@YOUR_HOST:17017/im_system?authSource=app", + "Redis": "YOUR_HOST:16379,password=YOUR_REDIS_PASSWORD,abortConnect=false" + }, + "RabbitMq": { + "Host": "YOUR_HOST", + "Username": "rag", + "Password": "YOUR_RABBITMQ_PASSWORD" + }, + "S3": { + "Endpoint": "http://YOUR_HOST:39200", + "AccessKey": "YOUR_S3_ACCESS_KEY", + "SecretKey": "YOUR_S3_SECRET_KEY" + }, + "Jwt": { + "SigningKey": "YOUR_SIGNING_KEY_AT_LEAST_32_CHARS_LONG" + }, + "Ai": { + "ApiKey": "YOUR_AI_API_KEY" + } +} diff --git a/src/BuildFlow.Host/appsettings.json b/src/BuildFlow.Host/appsettings.json index 860d6a2..4c9b39f 100644 --- a/src/BuildFlow.Host/appsettings.json +++ b/src/BuildFlow.Host/appsettings.json @@ -18,9 +18,9 @@ }, "AllowedHosts": "*", "ConnectionStrings": { - "Default": "Host=43.134.235.58;Port=15432;Username=rag;Password=REDACTED_PG_PASSWORD", - "MongoDb": "mongodb://appuser:REDACTED_MONGO_PASSWORD@43.134.235.58:17017/im_system?authSource=app", - "Redis": "43.134.235.58:16379,password=REDACTED_REDIS_PASSWORD,abortConnect=false" + "Default": "Host=127.0.0.1;Port=15432;Username=rag;Password=REPLACE_IN_SECRETS", + "MongoDb": "mongodb://appuser:REPLACE_IN_SECRETS@127.0.0.1:17017/im_system?authSource=app", + "Redis": "127.0.0.1:16379,password=REPLACE_IN_SECRETS,abortConnect=false" }, "DatabaseNames": { "Rag": "rag", @@ -30,15 +30,15 @@ "Platform": "platform" }, "RabbitMq": { - "Host": "43.134.235.58", + "Host": "127.0.0.1", "Port": 25672, "Username": "rag", - "Password": "REDACTED_RABBITMQ_PASSWORD" + "Password": "REPLACE_IN_SECRETS" }, "S3": { - "Endpoint": "http://43.134.235.58:39200", - "AccessKey": "REDACTED_S3_ACCESS", - "SecretKey": "REDACTED_S3_SECRET", + "Endpoint": "http://127.0.0.1:39200", + "AccessKey": "REPLACE_IN_SECRETS", + "SecretKey": "REPLACE_IN_SECRETS", "Region": "us-east-1" }, "KkFileView": { @@ -46,7 +46,7 @@ }, "Jwt": { "RequireHttps": false, - "SigningKey": "REDACTED_JWT_SIGNING_KEY_MIN_32_CHARS!!", + "SigningKey": "REPLACE_IN_SECRETS_MIN_32_CHARS", "Issuer": "http://localhost:5211", "Audience": "rag-frontend", "AccessTokenMinutes": 240, @@ -64,7 +64,7 @@ }, "Ai": { "BaseUrl": "http://localhost:1234/v1", - "ApiKey": "lm-studio", + "ApiKey": "REPLACE_IN_SECRETS", "ChatModel": "qwen/qwen3.6-27b", "EmbeddingModel": "text-embedding-embeddinggemma-300m", "DefaultInstructions": "你是 BuildFlow AI 助手。普通对话直接回答；当消息明确包含知识库上下文时，优先基于上下文回答。不要输出“作为RAG知识库助手”等身份开场、Markdown标题或推理过程；不要因为普通对话没有上下文就要求用户补充资料。", diff --git a/src/modules/file/Infrastructure/Persistence/FileDbContextDesignTimeFactory.cs b/src/modules/file/Infrastructure/Persistence/FileDbContextDesignTimeFactory.cs index 5685d91..14fd8a8 100644 --- a/src/modules/file/Infrastructure/Persistence/FileDbContextDesignTimeFactory.cs +++ b/src/modules/file/Infrastructure/Persistence/FileDbContextDesignTimeFactory.cs @@ -36,6 +36,7 @@ public class FileDbContextDesignTimeFactory : IDesignTimeDbContextFactory