qing
9ccb9cbdca
Migrate gateway from local -i ini file to the unified confs configuration
service, following the same two-layer pattern as Python services (dnfs/db/static):
- Add confs/configs/gateway.ini with all existing settings plus new
[Downstream] section for db/captcha/smtp host:port (previously hardcoded).
- Conf.hpp: add fromString() to parse ini from text (confs response),
env()/env_int() static helpers for environment variables, public default
constructor, and empty-filename guard in file constructor.
- DbC.hpp: add init(host, port) static method and static _host/_port members,
replacing hardcoded "127.0.0.1":8005. Defaults preserved for backward compat.
- main.cpp:
* Rewrite config loading: bootstrap CONFS_HOST/CONFS_PORT from env
(default 127.0.0.1:8010), fetch gateway.ini via pymsg from confs
(retry_on_refused=true), parse with ConfIni::fromString().
* -i flag is now optional; when provided, reads local ini (dev/debug mode).
* Add downstream host/port globals (_DB_HOST/_DB_PORT, _CAPTCHA_HOST/_CAPTCHA_PORT,
_SMTP_HOST/_SMTP_PORT, _CONFS_HOST/_CONFS_PORT), populated from [Downstream].
* Environment variable overrides (highest priority): LISTEN_ADDR/LISTEN_PORT,
DB_HOST/DB_PORT, CAPTCHA_HOST/CAPTCHA_PORT, SMTP_HOST/SMTP_PORT.
* Config integrity validation: required fields (Server.address/port,
Proxy.default, Downstream.db_host/db_port) cause startup failure if missing.
* Initialize DbC::init() and logs().set_endpoint() after config load.
* Replace all hardcoded "127.0.0.1":8005/8008/8009 in captcha/smtp/db calls
with configurable globals.
* Add downstream service info to startup log output.
* Fix: -v/--version flag now actually prints version and exits.
* Bump version to 0.7.0.
- _run.sh: remove -i example.ini default; now starts without args (confs mode),
passes "$@" through for optional -i override.
- Update README with new config loading docs, Downstream config section,
updated directory structure, and v0.7.0 changelog.
54 lines
2.1 KiB
INI
54 lines
2.1 KiB
INI
[Server]
|
||
# 当 WAF 在前面终止 TLS 时，gateway 退化为内部 HTTP 服务：
|
||
# - tls = off 启用 HTTP 模式（配合 waf 模块使用）
|
||
# - tls = on 启用 HTTPS 模式（独立部署，证书为 full_chain.crt / server.key）
|
||
address = 127.0.0.1
|
||
port = 8443
|
||
tls = off
|
||
|
||
[Proxy]
|
||
default = http://127.0.0.1:9200
|
||
closed = http://127.0.0.1:8005;http://127.0.0.1:8007;
|
||
opened = http://127.0.0.1:9200;http://127.0.0.1:8006;
|
||
|
||
[Token]
|
||
# Token 有效期（秒），默认 3600 = 1 小时
|
||
keep_time = 3600
|
||
# Token 刷新宽限期倍数：过期后 iat + keep_time * 倍数 窗口内仍可刷新，默认 2
|
||
refresh_grace_multiplier = 2
|
||
# Token 生命周期内最大刷新次数，超过后需重新登录，默认 10
|
||
max_refresh = 10
|
||
|
||
[Admin]
|
||
# 管理员账号白名单（分号分隔）。登录时命中即在 Token payload 写入 is_admin=true，
|
||
# 下游服务（dnfs 等）凭该字段豁免所有权校验，无需各自维护名单。
|
||
# 修改后需重启 gateway 生效；旧 Token 无此字段，按非管理员处理。
|
||
users = qing@qsont.me;shufeng@qsont.me
|
||
|
||
[CORS]
|
||
# 允许跨域的 Origin 白名单（分号分隔）
|
||
# 仅命中的 Origin 才会回填 Access-Control-Allow-Origin；缺省为空（不回填）
|
||
allowed_origins = https://qsont.me;https://www.qsont.me;http://127.0.0.1:8443;http://localhost:8443
|
||
|
||
[Database]
|
||
path = sqlite3.db
|
||
|
||
[WsProxy]
|
||
# WebSocket 反向代理路由（仅管理员可访问）
|
||
# 格式：routes = /path=ws://host:port/target;/path2=ws://host2:port2/target2
|
||
# 握手阶段会校验 HTTP Upgrade 请求中的 Token（Authorization: Bearer xxx 或 Cookie: q4_token=xxx），
|
||
# 仅 Token 中 is_admin=true 的用户才能升级连接；非管理员或无 Token 直接拒绝。
|
||
# 支持 ws:// 和 wss:// 后端
|
||
# 示例：routes = /ws/aibox=ws://127.0.0.1:8765;/ws/other=wss://example.com/ws
|
||
routes = /ws/aibox=ws://127.0.0.1:8765;
|
||
|
||
[Downstream]
|
||
# 下游 pymsg 服务地址（其他微服务的 host:port）
|
||
# 环境变量可覆盖：DB_HOST/DB_PORT, CAPTCHA_HOST/CAPTCHA_PORT, SMTP_HOST/SMTP_PORT, CONFS_HOST/CONFS_PORT
|
||
db_host = 127.0.0.1
|
||
db_port = 8005
|
||
captcha_host = 127.0.0.1
|
||
captcha_port = 8009
|
||
smtp_host = 127.0.0.1
|
||
smtp_port = 8008
|