the historical defaults dc3.security.key.2026.io.github.pnoker and
io.github.pnoker.dc3 are public in this repository, so any deployment
that never overrode them shipped a known hmac signing key
- app/scale/swarm compose: fail fast (${var:?}) when dc3_security_key
or auth_hmac_secret is unset; dev compose keeps a clearly-marked
dev-only default
- helm production/default values and k8s secret.env ship empty values:
pre/pro startup rejects blank and known-default hmac keys, forcing
--set-string or an existingsecret; document the per-key failure mode
honestly instead of overpromising startup rejection for both
- dev env files: rotate both keys to machine-generated dev-only values
and add throwaway rs256 material for local oauth flows
- fix the chart maintainer email to a syntactically valid address
Join 1242 keyword-split statement lines (COMMENT/CREATE/ALTER/LOAD), move the dc3_identity_audit_log table section and the schema fingerprint INSERT so every script orders DDL before seed data, and drop one duplicated COMMENT ON COLUMN. Statement multiset verified identical apart from the intended dedup. The canonical fingerprint changes to e81e3562... and is synchronized via schema_fingerprint.py --sync into the embedded ddl_hash and all four distribution points; existing initialized databases require re-initialization (flag day).
- migrate auth, manager, data, and agentic persistence to R2DBC
- hard cut pagination, facade, gateway, web, and CLI contracts
- remove legacy database and TSDB adapters and document validation gates
BREAKING CHANGE: platform persistence now requires PostgreSQL 18 with TimescaleDB and the new reactive API contracts.
- gateway container env passes DC3_GATEWAY_OAUTH_ENABLED/JWKS_URL so
deployments can turn RS256 verification on without image changes
- PrincipalHeader regains a 7-arg constructor delegating scopes=null,
keeping ~15 existing call sites compiling against the new field
- include dc3-db in the make deploy artifact set alongside common/mq/tsdb
- sample DC3_DB_TYPE/DC3_TSDB_TYPE and external-store ports in .env.example
- expose mysql/mariadb/tdengine/influxdb/iotdb/jaeger in the compose stacks
- update AGENTS.md module map and module-ownership guidance
- add the missing AGPL header to the oracle driver service
- add ble, can, dlt645, dnp3, iec61850, kafka, knx, lorawan, mbus, redis, and zigbee to the k8s driver list, kustomization, helm values, and compose service stacks
- regenerate k8s driver deployments and preserve the listening-virtual ports in the generator
- replace the per-driver named volumes with one shared driver_data volume isolated by mount path, matching the scale/swarm stacks
- correct scaling docs: compose scale/swarm drivers stay at one replica because replicas would share one SQLite outbox file
Use PostgreSQL leases and fencing for distributed ownership, require a durable SQLite outbox before RabbitMQ publication, and make Data Center ingestion transactional and idempotent.
BREAKING CHANGE: drivers require mandatory durable outbox configuration and use lease-aware ownership and telemetry contracts.
28 driver application.yml add dc3.driver.buffer; Dockerfile each stage adds dc3/data dir and VOLUME; docker-compose main/dev add driver_data named volume
* ci(dependabot): add cargo ecosystem, groups, and clean up stale docker directories
* docs(ai): add spring-ai-deep-dive cross-references in en and zh indexes
* docs(community): add english FAQ and frontend developer guide
* chore(issue-templates): translate all templates to english
* ci(docker): add 20 missing driver images to Dockerfile, compose, and Makefile
* fix(docs): remove Vue template syntax from panorama SVGs so they render
* docs(ai): add spring-ai-deep-dive pages in en and zh
Set AUTH_HMAC_SECRET default to "io.github.pnoker.dc3" across .env
templates, compose files, and Java config properties so that X-Auth-User
header signing is active out of the box without manual configuration.
Add dc3-web frontend service to docker-compose.yml with nginx reverse
proxy as the sole user-facing entry point. Remove backend port mappings
since web now proxies to gateway.
Merge docker-compose-elasticsearch.yml and docker-compose-grafana.yml
into a single docker-compose-optional.yml that includes EMQX, ELK+APM,
and Prometheus+Grafana stacks.
Expose AGENTIC_MEMORY_ENABLED, AGENTIC_TOOL_CALLING_ENABLED,
AGENTIC_MEMORY_MAX_MESSAGES, and AGENTIC_ATTACHMENT_STORAGE_PATH
in development and production compose files, with defaults in dev.env.
Also mark OpenAI base-url config as deprecated in application-agentic.yml.
The HMAC signing feature was dormant because no deployment config
set the shared secret. Add AUTH_HMAC_SECRET to .env.example, dev
env files, both compose stacks (all 12 services), and document it
in ENVIRONMENT.md.
Standardized the use of double quotes in docker-compose files for consistency. Added new docker-compose files for optional and Aliyun configurations to support different deployment environments.
pnoker