| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788 |
- # DataOps Platform production environment variables
- # 部署脚本首次运行时会复制到 /etc/dataops-platform/dataops.env
- # 部署前请替换所有 replace-* 占位符为真实值
- FLASK_ENV=production
- SECRET_KEY=replace-with-a-long-random-secret
- # Dedicated HMAC key for short-lived AI rule generation receipts.
- # Generate independently with: openssl rand -hex 32
- RULE_GENERATION_RECEIPT_SECRET=replace-with-dedicated-64-hex-random-value
- # Dedicated HMAC key for governance audit evidence seals.
- # Generate independently with: openssl rand -hex 32
- AUDIT_EVIDENCE_SECRET=replace-with-dedicated-64-hex-random-value
- AUDIT_EVIDENCE_KEY_VERSION=v1
- # Comma-separated exact hostnames. Keep empty until enterprise SIEM is approved.
- SECURITY_SIEM_HOST_ALLOWLIST=
- # Exact local Nginx/reverse-proxy addresses authorized to supply edge mTLS proof.
- EDGE_MTLS_TRUSTED_PROXY_IPS=127.0.0.1
- # 平台 PostgreSQL：DBA role-init、schema migrator、常驻 runtime 三种身份必须分离。
- # role-init 身份仅在一次性预置/轮换步骤使用，需 CREATEROLE；不得注入 Gunicorn。
- DB_ROLE_INIT_DATABASE_URL=postgresql://dataops_role_admin:replace-role-init-password@127.0.0.1:5432/dataops
- MIGRATION_DATABASE_URL=postgresql://dataops_migrator:replace-migration-password@127.0.0.1:5432/dataops
- DATABASE_URL=postgresql://dataops_app:replace-runtime-password@127.0.0.1:5432/dataops
- BI_AI_CATALOG_CONTROL_DATABASE_URL=postgresql://dataops_bi_ai_catalog_control:replace-bi-ai-catalog-control-password@127.0.0.1:5432/dataops
- DATAOPS_MIGRATOR_USER=dataops_migrator
- DATAOPS_RUNTIME_USER=dataops_app
- DATAOPS_RUNTIME_PASSWORD=replace-runtime-password
- DATAOPS_BI_AI_CATALOG_CONTROL_USER=dataops_bi_ai_catalog_control
- DATAOPS_BI_AI_CATALOG_CONTROL_PASSWORD=replace-bi-ai-catalog-control-password
- # Neo4j
- NEO4J_URI=bolt://127.0.0.1:7687
- NEO4J_HTTP_URI=http://127.0.0.1:7474
- NEO4J_USER=neo4j
- NEO4J_PASSWORD=replace-neo4j-password
- # MinIO（host/user/password/bucket 须整组匹配同一 MinIO 实例）
- MINIO_HOST=127.0.0.1:9000
- MINIO_USER=replace-minio-user
- MINIO_PASSWORD=replace-minio-password
- MINIO_SECURE=false
- MINIO_BUCKET=dataops-bucket
- MINIO_PREFIX=
- # n8n
- N8N_API_URL=http://127.0.0.1:5678
- N8N_API_KEY=replace-n8n-api-key
- N8N_API_TIMEOUT=30
- # DeepSeek LLM（OpenAI 兼容 SDK，base_url 不要带 /v1）
- DEEPSEEK_API_KEY=replace-with-your-deepseek-api-key
- LLM_BASE_URL=https://api.deepseek.com
- LLM_MODEL_NAME=deepseek-chat
- LLM_REASONING_EFFORT=high
- # 服务配置
- API_BASE_URL=http://127.0.0.1:5500/api
- DATAFLOW_SCHEMA=dags
- # 外部业务数据源连接池（不用于平台自身 PostgreSQL）
- DATASOURCE_CREDENTIAL_MASTER_KEY=replace-with-base64-32-byte-key
- DATASOURCE_CREDENTIAL_KEY_VERSION=v1
- DATASOURCE_POOL_SIZE=2
- DATASOURCE_MAX_OVERFLOW=3
- DATASOURCE_POOL_TIMEOUT=10
- DATASOURCE_POOL_RECYCLE=1800
- DATASOURCE_POOL_IDLE_TTL=900
- DATASOURCE_MAX_IDLE_POOLS=20
- DATASOURCE_QUERY_TIMEOUT=30
- DATASOURCE_CERT_DIR=/etc/dataops-platform/datasource-certs
- # 运行时路径
- UPLOAD_BASE_PATH=/data/upload
- ARCHIVE_BASE_PATH=/data/archive
- LOG_LEVEL=INFO
- LOG_DIR=/opt/dataops-platform/logs
- LOG_FILE=/opt/dataops-platform/logs/flask_production.log
- LOG_TO_CONSOLE=false
- # Gunicorn（Supervisor 通过 scripts/run_dataops.sh 读取）
- LISTEN_HOST=0.0.0.0
- LISTEN_PORT=5500
- PORT=5500
- GUNICORN_WORKERS=4
- GUNICORN_TIMEOUT=120
- EDGE_GATEWAY_SIGNING_PRIVATE_KEY_FILE=/etc/dataops-platform/secrets/edge-gateway-signing.key
- EDGE_GATEWAY_SIGNING_PUBLIC_KEY=replace-edge-signing-public-key
- EDGE_GATEWAY_SIGNING_KEY_ID=replace-edge-signing-key-id
|
