姚章浩
533db535f1
build / build (push) Successful in 1m12s
按已确认需求提供独立安全模型配置、真实探测、正式字典字段评估与原问题译中，持久批次支持只补空白、暂停恢复、有限重试、幂等和逐字段依据。覆盖固定规则、本地语言、组织关联与主表有效看板共用治理侧读模型，保留源生产和冻结历史。 验证：完整 make verify 退出0，702项Go与329项前端通过；默认118项外部/隔离集成明确跳过，另跑完整镜像及组织隔离PG竞态。12并发、输入漂移、过期租约、暂停/恢复及有限重试通过。用户授权的百炼 deepseek-v4.1-flash 完成真实后台与浏览器评估/翻译；552行、16列、11块看板及完整PNG、独立配置页测试/保存、重开恢复和零JS异常通过。仅非业务样本外发，自动处理关闭，原payload不变。 上线前治理库已做导出快照原生备份并真实恢复，60表行数与17个QA表内容哈希一致；不修改DobotAI生产或隧道。本提交时尚未部署，线上验收须独立完成。
74 lines
3.2 KiB
Bash
74 lines
3.2 KiB
Bash
# Optional independent source, disabled by default. Never use the app writer or
|
||
# substitute DATABASE_URL. Backend credential file must be a regular 0600 file.
|
||
DOBOTAI_OPS_READ_ENABLED=false
|
||
DOBOTAI_OPS_READ_DSN_FILE=
|
||
DOBOTAI_OPS_TENANT_KEY=
|
||
DOBOTAI_OPS_DIAL_MODE=direct
|
||
DOBOTAI_OPS_SSH_TARGET=
|
||
DOBOTAI_OPS_CONNECT_TIMEOUT=5s
|
||
DOBOTAI_OPS_QUERY_TIMEOUT=4s
|
||
DOBOTAI_OPS_MAX_CONNS=2
|
||
DOBOTAI_OPS_MIN_CONNS=0
|
||
|
||
# API and worker share this opt-in binding; no browser-selected paths/credentials.
|
||
# Runtime root is the read-only existing weekly_report directory (SDK/config and
|
||
# private secret file). Python must be compatible and already provide PyYAML.
|
||
# Container deployment requires approved runtime/script mounts; not auto-installed.
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_ENABLED=false
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_PYTHON=
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_SCRIPT=
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_RUNTIME_ROOT=
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_SPOOL_ROOT=
|
||
DOBOTAI_OPS_DIRECTORY_SYNC_TIMEOUT=20m
|
||
|
||
# Independent governance AI: endpoint/model/write-only API key are stored via the admin page.
|
||
# Mount the same 32-byte regular 0600 master-key file into API and ordinary worker.
|
||
QA_AI_MASTER_KEY_FILE=
|
||
# Empty uses system DNS; alidns enables certificate-verified public DNS-over-TLS for this client only.
|
||
QA_AI_DNS_OVER_TLS=
|
||
# Only opt in behind an already trusted TLS-terminating same-origin reverse proxy.
|
||
QA_AI_TRUST_TLS_PROXY=false
|
||
|
||
APP_ADDR=:8080
|
||
DATABASE_URL=postgres://governance@postgres:5432/governance?sslmode=disable
|
||
PGPASSFILE=/run/secrets/pgpass
|
||
WORKER_ID=worker-1
|
||
WORKER_POLL_INTERVAL=1s
|
||
WORKER_LEASE_DURATION=30s
|
||
WORKER_RETRY_DELAY=5s
|
||
RELEASE_WORKER_ENABLED=false
|
||
PRODUCTION_RELEASE_REQUESTS_ENABLED=false
|
||
# Read-only probe of the production WeKnora endpoint (console shows its real
|
||
# state); the publish target itself stays in RELEASE_CONFIG_FILE.
|
||
PRODUCTION_WEKNORA_BASE_URL=
|
||
PRODUCTION_WEKNORA_API_KEY_FILE=
|
||
PRODUCTION_WEKNORA_ALLOW_DOCKER_HTTP=false
|
||
PP_SCAN_ENABLED=false
|
||
PP_SCAN_HOST_DATA_ROOT=/home/zheromiku/dobot-portal-sync/data
|
||
PP_SCAN_CONTAINER_DATA_ROOT=/home/zheromiku/dobot-portal-sync/data
|
||
TEST_WEKNORA_ENABLED=false
|
||
TEST_WEKNORA_ALLOW_DOCKER_HTTP=false
|
||
TEST_WEKNORA_BASE_URL=
|
||
MINERU_BASE_URL=
|
||
TEST_WEKNORA_KB_ID=
|
||
TEST_WEKNORA_API_KEY_FILE=/run/secrets/test_weknora_api_key
|
||
GOVERNANCE_SPOOL_ROOT=/var/lib/governance/spool
|
||
TEST_WEKNORA_HTTP_TIMEOUT=60s
|
||
TEST_WEKNORA_POLL_INITIAL=10s
|
||
TEST_WEKNORA_POLL_MAX=60s
|
||
TEST_WEKNORA_STALLED_AFTER=30m
|
||
TEST_WEKNORA_MAX_UPLOAD_BYTES=52428800
|
||
TEST_ACCEPTANCE_POLICY_VERSION=structural-v1
|
||
|
||
# 「版本记录」页：**匿名只读**远端仓库的提交与 tag（**不使用任何凭据**）。
|
||
# 留空即"未接线"（页面降级展示、同步按钮不可用）。只允许下面批准的 origin 与固定仓库，
|
||
# 不接受任何调用方传入的 URL；`VERSION_HISTORY_REPO` 必须是 owner/name。
|
||
VERSION_HISTORY_GITEA_BASE_URL=
|
||
VERSION_HISTORY_REPO=Weknora/knowledge-governance
|
||
VERSION_HISTORY_ALLOWED_ORIGINS=
|
||
# 页面上的「查看提交 / 查看 tag」链接用哪个 origin —— 抓取可以走内网，但链接必须能被
|
||
# **点它的人**打开（否则点开是空白）。留空 = 与上面的抓取地址相同。
|
||
VERSION_HISTORY_LINK_ORIGIN=https://gitea.zheromiku.top
|
||
VERSION_HISTORY_HTTP_TIMEOUT=15s
|
||
VERSION_HISTORY_MAX_PAGES=200
|