mirror of
https://gitee.com/pnoker/iot-dc3.git
synced 2026-09-01 15:33:10 +08:00
Vickey
27bcf1383b
Security (CRITICAL): - KeyUtil: read JWT signing key from DC3_SECURITY_KEY env/property - UserPasswordServiceImpl: read default password from DC3_SECURITY_DEFAULT_PASSWORD env - KeyLoader: read OPC-UA keystore password from OPCUA_KEYSTORE_PASSWORD env - WebFilterConfig: return 401 on malformed X-Auth-User header - AlgorithmConstant: document deprecated hardcoded constants Thread safety (HIGH): - Fix TOCTOU races in 4 driver connectors (computeIfAbsent) - Fix PlcS7 lock leak, OpcUa connect timeout (5s) - CoapClientManager: synchronize setURI to prevent URI race - PointValueJob, MqttScheduleJob: add @DisallowConcurrentExecution - SystemHealthServiceImpl: preserve interrupt flag - WindowSampleBuffer: local AtomicInteger → int Performance (MEDIUM): - EntityStateExpiryScanner: batch alarm saves (saveBatch) - ImportDeviceServiceImpl: batch config saves - ResourceRegistrySyncServiceImpl: batch-load nodes, eliminate N+1 COUNTs - DriverSenderServiceImpl: debug-gate hot-path logging - PointServiceImpl: stream().count() → size() Null safety (LOW): - RegexUtil: null guards on isName/isPhone/isMail/isPassword/isHost - HostUtil: null-check getNetworkInterfaces() return - TimeUtil: log parse failures instead of silent null Infrastructure: - Add spring-boot-starter-cache + @EnableCaching CacheConfig - Replace embedded modbus4j/plc-s7 jars with external Maven dependencies - Add dc3-driver-modbus-rtu module
378 lines
12 KiB
YAML
378 lines
12 KiB
YAML
#
|
|
# Copyright 2016-present the IoT DC3 original author or authors.
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as
|
|
# published by the Free Software Foundation, either version 3 of the
|
|
# License, or (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
x-logging: &default-logging
|
|
driver: json-file
|
|
options:
|
|
max-size: ${DC3_LOG_MAX_SIZE:-10M}
|
|
max-file: "${DC3_LOG_MAX_FILE:-20}"
|
|
|
|
services:
|
|
web:
|
|
# Frontend follows the same DC3_IMAGE_REGISTRY switch as backend services
|
|
# (so `make app REGISTRY=cn` retags everything together), but keeps
|
|
# an independent DC3_WEB_VERSION because the UI ships on its own cadence.
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-web:${DC3_WEB_VERSION:-latest}
|
|
restart: always
|
|
depends_on:
|
|
gateway:
|
|
condition: service_healthy
|
|
ports:
|
|
- "${DC3_BIND_HOST:-127.0.0.1}:${DC3_WEB_HTTP_PORT:-8080}:80"
|
|
- "${DC3_BIND_HOST:-127.0.0.1}:${DC3_WEB_HTTPS_PORT:-8443}:443"
|
|
environment:
|
|
- APP_API_HOST=${APP_API_HOST:-dc3-gateway}
|
|
- APP_API_PORT=${APP_API_PORT:-8000}
|
|
container_name: dc3-web
|
|
hostname: dc3-web
|
|
volumes:
|
|
- nginx:/var/log/nginx
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1/ >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 30s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-web
|
|
|
|
gateway:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-gateway:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
auth:
|
|
condition: service_healthy
|
|
manager:
|
|
condition: service_healthy
|
|
data:
|
|
condition: service_healthy
|
|
agentic:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-gateway
|
|
hostname: dc3-gateway
|
|
volumes:
|
|
- logs:/dc3-gateway/dc3/logs
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:8000/actuator/health/readiness >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 30s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-gateway
|
|
|
|
auth:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-center-auth:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-center-auth
|
|
hostname: dc3-center-auth
|
|
volumes:
|
|
- logs:/dc3-center/dc3-center-auth/dc3/logs
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:8300/auth/actuator/health/readiness >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 40s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-center-auth
|
|
|
|
manager:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-center-manager:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
auth:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-center-manager
|
|
hostname: dc3-center-manager
|
|
volumes:
|
|
- logs:/dc3-center/dc3-center-manager/dc3/logs
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:8400/manager/actuator/health/readiness >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 40s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-center-manager
|
|
|
|
data:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-center-data:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
auth:
|
|
condition: service_healthy
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-center-data
|
|
hostname: dc3-center-data
|
|
volumes:
|
|
- logs:/dc3-center/dc3-center-data/dc3/logs
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:8500/data/actuator/health/readiness >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 40s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-center-data
|
|
|
|
agentic:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-center-agentic:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
auth:
|
|
condition: service_healthy
|
|
manager:
|
|
condition: service_healthy
|
|
data:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
- AGENTIC_FALLBACK_OPENAI_BASE_URL=${AGENTIC_FALLBACK_OPENAI_BASE_URL:-https://api.openai.com}
|
|
- AGENTIC_FALLBACK_OPENAI_API_KEY=${AGENTIC_FALLBACK_OPENAI_API_KEY:-}
|
|
- AGENTIC_FALLBACK_OPENAI_MODEL=${AGENTIC_FALLBACK_OPENAI_MODEL:-gpt-4o}
|
|
- AGENTIC_FALLBACK_OPENAI_TEMPERATURE=${AGENTIC_FALLBACK_OPENAI_TEMPERATURE:-0.7}
|
|
- AGENTIC_FALLBACK_OPENAI_MAX_TOKENS=${AGENTIC_FALLBACK_OPENAI_MAX_TOKENS:-2048}
|
|
- AGENTIC_MEMORY_SCHEMA_INIT=${AGENTIC_MEMORY_SCHEMA_INIT:-never}
|
|
- AGENTIC_MEMORY_ENABLED=${AGENTIC_MEMORY_ENABLED:-false}
|
|
- AGENTIC_TOOL_CALLING_ENABLED=${AGENTIC_TOOL_CALLING_ENABLED:-true}
|
|
- AGENTIC_MEMORY_MAX_MESSAGES=${AGENTIC_MEMORY_MAX_MESSAGES:-50}
|
|
- AGENTIC_ATTACHMENT_STORAGE_PATH=${AGENTIC_ATTACHMENT_STORAGE_PATH:-dc3/data/agentic/attachments}
|
|
container_name: dc3-center-agentic
|
|
hostname: dc3-center-agentic
|
|
volumes:
|
|
- logs:/dc3-center/dc3-center-agentic/dc3/logs
|
|
healthcheck:
|
|
test: [ "CMD-SHELL", "curl -fsS http://127.0.0.1:8600/agentic/actuator/health/readiness >/dev/null || exit 1" ]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 10
|
|
start_period: 40s
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-center-agentic
|
|
|
|
listening-virtual:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-listening-virtual:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
# Device ingress ports — kept exposed because external device simulators
|
|
# (or real IoT devices) connect in over TCP/UDP. All other backend ports
|
|
# are intentionally NOT mapped: web is the only user-facing entry point.
|
|
ports:
|
|
- "${DC3_BIND_HOST:-127.0.0.1}:${DC3_LISTENING_VIRTUAL_TCP_PORT:-6270}:6270"
|
|
- "${DC3_BIND_HOST:-127.0.0.1}:${DC3_LISTENING_VIRTUAL_UDP_PORT:-6271}:6271"
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-listening-virtual
|
|
hostname: dc3-driver-listening-virtual
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-listening-virtual/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-listening-virtual
|
|
|
|
modbus-tcp:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-modbus-tcp:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-modbus-tcp
|
|
hostname: dc3-driver-modbus-tcp
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-modbus-tcp/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-modbus-tcp
|
|
|
|
modbus-rtu:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-modbus-rtu:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-modbus-rtu
|
|
hostname: dc3-driver-modbus-rtu
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-modbus-rtu/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-modbus-rtu
|
|
|
|
mqtt:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-mqtt:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-mqtt
|
|
hostname: dc3-driver-mqtt
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-mqtt/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-mqtt
|
|
|
|
opc-da:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-opc-da:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-opc-da
|
|
hostname: dc3-driver-opc-da
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-opc-da/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-opc-da
|
|
|
|
opc-ua:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-opc-ua:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-opc-ua
|
|
hostname: dc3-driver-opc-ua
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-opc-ua/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-opc-ua
|
|
|
|
plcs7:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-plcs7:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-plcs7
|
|
hostname: dc3-driver-plcs7
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-plcs7/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-plcs7
|
|
|
|
virtual:
|
|
image: ${DC3_IMAGE_REGISTRY:-pnoker}/dc3-driver-virtual:${DC3_IMAGE_TAG:-2026.5}
|
|
restart: always
|
|
depends_on:
|
|
manager:
|
|
condition: service_healthy
|
|
environment:
|
|
- NODE_ENV=test
|
|
- APM_AGENT_ENABLE=${APM_AGENT_ENABLE:-false}
|
|
- AUTH_HMAC_SECRET=${AUTH_HMAC_SECRET:-io.github.pnoker.dc3}
|
|
container_name: dc3-driver-virtual
|
|
hostname: dc3-driver-virtual
|
|
volumes:
|
|
- logs:/dc3-driver/dc3-driver-virtual/dc3/logs
|
|
logging: *default-logging
|
|
networks:
|
|
dc3net:
|
|
aliases:
|
|
- dc3-driver-virtual
|
|
|
|
volumes:
|
|
logs:
|
|
nginx:
|
|
|
|
networks:
|
|
dc3net:
|
|
driver: bridge
|