Skip to content

Commit 95b96f8

Browse files
lexburnerlexburner
committed
chore: 移除硬编码的 JWT_SECRET 和密码逻辑
1 parent feef6ba commit 95b96f8

File tree

4 files changed

+87
-43
lines changed

4 files changed

+87
-43
lines changed

‎deploy/docker/.env.example‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,22 @@ REDIS_IMAGE=higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/redis-stack-ser
1717
SANDBOX_IMAGE=opensource-registry.cn-hangzhou.cr.aliyuncs.com/higress-group/sandbox:latest
1818

1919
# ========== 数据库密码 ==========
20-
# 必须固定，否则重装时本地数据与新密码不匹配
21-
MYSQL_ROOT_PASSWORD=himarket_root_2024
22-
MYSQL_PASSWORD=himarket_app_2024
20+
# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
21+
# 如需自定义，取消注释并填写
22+
# MYSQL_ROOT_PASSWORD=
23+
# MYSQL_PASSWORD=
2324

2425
# ========== 服务凭证 ==========
25-
NACOS_ADMIN_PASSWORD=nacos
26-
HIGRESS_USERNAME=admin
27-
HIGRESS_PASSWORD=admin
26+
# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
27+
# NACOS_ADMIN_PASSWORD=
28+
# HIGRESS_USERNAME=admin
29+
# HIGRESS_PASSWORD=
2830

2931
# ========== 默认用户 ==========
3032
ADMIN_USERNAME=admin
31-
ADMIN_PASSWORD=admin
33+
# ADMIN_PASSWORD=
3234
FRONT_USERNAME=user
33-
FRONT_PASSWORD=123456
35+
# FRONT_PASSWORD=
3436

3537
# ========== AI 模型配置（可选）==========
3638
SKIP_AI_MODEL_INIT=true

‎deploy/docker/install.sh‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,26 @@ prompt_optional() {
270270
eval "export ${var_name}='${value}'"
271271
}
272272

273+
# ── generate_password — 生成随机安全密码 ─────────────────────────────────────
274+
generate_password() {
275+
local len="${1:-16}"
276+
openssl rand -base64 48 | tr -d '/+=\n' | head -c "${len}"
277+
}
278+
279+
# ── ensure_secrets — 首次安装时为空密码字段生成随机值 ─────────────────────────
280+
# 在 load_config() 之后调用。如果 env 文件已加载了密码，则不会覆盖。
281+
ensure_secrets() {
282+
: "${MYSQL_ROOT_PASSWORD:=$(generate_password)}"
283+
: "${MYSQL_PASSWORD:=$(generate_password)}"
284+
: "${JWT_SECRET:=$(openssl rand -base64 32)}"
285+
: "${NACOS_ADMIN_PASSWORD:=$(generate_password)}"
286+
: "${HIGRESS_PASSWORD:=$(generate_password)}"
287+
: "${ADMIN_PASSWORD:=$(generate_password)}"
288+
: "${FRONT_PASSWORD:=$(generate_password)}"
289+
export MYSQL_ROOT_PASSWORD MYSQL_PASSWORD JWT_SECRET \
290+
NACOS_ADMIN_PASSWORD HIGRESS_PASSWORD ADMIN_PASSWORD FRONT_PASSWORD
291+
}
292+
273293
# =============================================================================
274294
# Docker 工具函数
275295
# =============================================================================
@@ -567,6 +587,11 @@ interactive_config() {
567587
DEPLOY_MODE="install"
568588
fi
569589

590+
# 新安装/重新安装时，为空的密码字段生成随机值
591+
if [[ "${DEPLOY_MODE}" != "upgrade" ]]; then
592+
ensure_secrets
593+
fi
594+
570595
# ─── 镜像配置 ───
571596
log ""
572597
log "$(msg section.image)"
@@ -577,38 +602,32 @@ interactive_config() {
577602
prompt NACOS_IMAGE "Nacos image" "nacos-registry.cn-hangzhou.cr.aliyuncs.com/nacos/nacos-server:v3.2.0-BETA"
578603
prompt HIGRESS_IMAGE "Higress image" "higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:latest"
579604

580-
# ─── 数据库密码 ───
605+
# ─── 数据库密码（首次安装时已自动生成随机值） ───
581606
log ""
582607
log "$(msg section.db)"
583-
prompt MYSQL_ROOT_PASSWORD "MySQL root password" "himarket_root_2024"
584-
prompt MYSQL_PASSWORD "MySQL app password" "himarket_app_2024"
608+
prompt MYSQL_ROOT_PASSWORD "MySQL root password" "${MYSQL_ROOT_PASSWORD:-}"
609+
prompt MYSQL_PASSWORD "MySQL app password" "${MYSQL_PASSWORD:-}"
585610
# 内置 MySQL：DB_* 始终指向容器内 MySQL
586611
export DB_HOST="mysql"
587612
export DB_PORT="3306"
588613
export DB_NAME="${MYSQL_DATABASE:-portal_db}"
589614
export DB_USERNAME="${MYSQL_USER:-portal_user}"
590615
export DB_PASSWORD="${MYSQL_PASSWORD}"
591616

592-
# ─── JWT Secret（自动生成随机值） ───
593-
if [[ -z "${JWT_SECRET:-}" ]]; then
594-
JWT_SECRET="$(openssl rand -base64 32)"
595-
fi
596-
export JWT_SECRET
597-
598-
# ─── 服务凭证 ───
617+
# ─── 服务凭证（首次安装时已自动生成随机值） ───
599618
log ""
600619
log "$(msg section.credential)"
601-
prompt NACOS_ADMIN_PASSWORD "Nacos admin password" "nacos"
620+
prompt NACOS_ADMIN_PASSWORD "Nacos admin password" "${NACOS_ADMIN_PASSWORD:-}"
602621
prompt HIGRESS_USERNAME "Higress console username" "admin"
603-
prompt HIGRESS_PASSWORD "Higress console password" "admin"
622+
prompt HIGRESS_PASSWORD "Higress console password" "${HIGRESS_PASSWORD:-}"
604623

605-
# ─── 默认用户 ───
624+
# ─── 默认用户（首次安装时密码已自动生成随机值） ───
606625
log ""
607626
log "$(msg section.user)"
608627
prompt ADMIN_USERNAME "Admin username" "admin"
609-
prompt ADMIN_PASSWORD "Admin password" "admin"
628+
prompt ADMIN_PASSWORD "Admin password" "${ADMIN_PASSWORD:-}"
610629
prompt FRONT_USERNAME "Developer username" "user"
611-
prompt FRONT_PASSWORD "Developer password" "123456"
630+
prompt FRONT_PASSWORD "Developer password" "${FRONT_PASSWORD:-}"
612631

613632
# ─── AI 模型配置（可选，支持多个）───
614633
log ""

‎deploy/helm/.env.example‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,22 @@ HIGRESS_REPO_URL=https://higress.cn/helm-charts
2323
HIGRESS_CHART_REF=higress.io/higress
2424

2525
# ========== 数据库密码 ==========
26-
# 必须固定，否则重装时 PVC 旧数据与新密码不匹配
27-
MYSQL_ROOT_PASSWORD=himarket_root_2024
28-
MYSQL_PASSWORD=himarket_app_2024
26+
# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
27+
# 如需自定义，取消注释并填写
28+
# MYSQL_ROOT_PASSWORD=
29+
# MYSQL_PASSWORD=
2930

3031
# ========== 服务凭证 ==========
31-
NACOS_ADMIN_PASSWORD=nacos
32-
HIGRESS_USERNAME=admin
33-
HIGRESS_PASSWORD=admin
32+
# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
33+
# NACOS_ADMIN_PASSWORD=
34+
# HIGRESS_USERNAME=admin
35+
# HIGRESS_PASSWORD=
3436

3537
# ========== 默认用户 ==========
3638
ADMIN_USERNAME=admin
37-
ADMIN_PASSWORD=admin
39+
# ADMIN_PASSWORD=
3840
FRONT_USERNAME=user
39-
FRONT_PASSWORD=123456
41+
# FRONT_PASSWORD=
4042

4143
# ========== 存储配置 ==========
4244
MYSQL_STORAGE_CLASS=alicloud-disk-essd

‎deploy/helm/install.sh‎

Lines changed: 33 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,26 @@ prompt_optional() {
313313
eval "export ${var_name}='${value}'"
314314
}
315315

316+
# ── generate_password — 生成随机安全密码 ─────────────────────────────────────
317+
generate_password() {
318+
local len="${1:-16}"
319+
openssl rand -base64 48 | tr -d '/+=\n' | head -c "${len}"
320+
}
321+
322+
# ── ensure_secrets — 首次安装时为空密码字段生成随机值 ─────────────────────────
323+
# 在 load_config() 之后调用。如果 env 文件已加载了密码，则不会覆盖。
324+
ensure_secrets() {
325+
: "${MYSQL_ROOT_PASSWORD:=$(generate_password)}"
326+
: "${MYSQL_PASSWORD:=$(generate_password)}"
327+
: "${JWT_SECRET:=$(openssl rand -base64 32)}"
328+
: "${NACOS_ADMIN_PASSWORD:=$(generate_password)}"
329+
: "${HIGRESS_PASSWORD:=$(generate_password)}"
330+
: "${ADMIN_PASSWORD:=$(generate_password)}"
331+
: "${FRONT_PASSWORD:=$(generate_password)}"
332+
export MYSQL_ROOT_PASSWORD MYSQL_PASSWORD JWT_SECRET \
333+
NACOS_ADMIN_PASSWORD HIGRESS_PASSWORD ADMIN_PASSWORD FRONT_PASSWORD
334+
}
335+
316336
# =============================================================================
317337
# Kubernetes / Helm 工具函数
318338
# =============================================================================
@@ -741,7 +761,8 @@ interactive_config() {
741761
prompt HIMARKET_MYSQL_IMAGE_TAG "MySQL image tag" "${HIMARKET_MYSQL_IMAGE_TAG:-latest}"
742762
prompt NACOS_VERSION "Nacos version" "${NACOS_VERSION:-v3.2.0-BETA}"
743763

744-
# 其他配置沿用已有值（从配置文件加载或回退默认值）
764+
# 其他配置沿用已有值（从配置文件加载）
765+
# 注意：回退默认值保留旧版硬编码值，仅用于兼容 env 文件缺失的已有部署
745766
NAMESPACE="${NAMESPACE:-himarket}"
746767
HIMARKET_HUB="${HIMARKET_HUB:-opensource-registry.cn-hangzhou.cr.aliyuncs.com/higress-group}"
747768
NACOS_IMAGE_REGISTRY="${NACOS_IMAGE_REGISTRY:-nacos-registry.cn-hangzhou.cr.aliyuncs.com}"
@@ -774,6 +795,8 @@ interactive_config() {
774795
done
775796
else
776797
# ─── 分组交互式提示（全新安装 / 重新安装）───
798+
ensure_secrets
799+
777800
log ""
778801
log "$(msg section.basic)"
779802
prompt NAMESPACE "Kubernetes namespace" "himarket"
@@ -787,28 +810,26 @@ interactive_config() {
787810
prompt NACOS_IMAGE_REGISTRY "Nacos image registry" "nacos-registry.cn-hangzhou.cr.aliyuncs.com"
788811
prompt NACOS_IMAGE_REPOSITORY "Nacos image repository" "nacos/nacos-server"
789812

813+
# ─── 数据库密码（首次安装时已自动生成随机值） ───
790814
log ""
791815
log "$(msg section.db)"
792-
prompt MYSQL_ROOT_PASSWORD "MySQL root password" "himarket_root_2024"
793-
prompt MYSQL_PASSWORD "MySQL app password" "himarket_app_2024"
794-
795-
# JWT Secret: 自动生成随机值（无需用户交互）
796-
if [[ -z "${JWT_SECRET:-}" ]]; then
797-
JWT_SECRET="$(openssl rand -base64 32)"
798-
fi
816+
prompt MYSQL_ROOT_PASSWORD "MySQL root password" "${MYSQL_ROOT_PASSWORD:-}"
817+
prompt MYSQL_PASSWORD "MySQL app password" "${MYSQL_PASSWORD:-}"
799818

819+
# ─── 服务凭证（首次安装时已自动生成随机值） ───
800820
log ""
801821
log "$(msg section.credential)"
802-
prompt NACOS_ADMIN_PASSWORD "Nacos admin password" "nacos"
822+
prompt NACOS_ADMIN_PASSWORD "Nacos admin password" "${NACOS_ADMIN_PASSWORD:-}"
803823
prompt HIGRESS_USERNAME "Higress console username" "admin"
804-
prompt HIGRESS_PASSWORD "Higress console password" "admin"
824+
prompt HIGRESS_PASSWORD "Higress console password" "${HIGRESS_PASSWORD:-}"
805825

826+
# ─── 默认用户（首次安装时密码已自动生成随机值） ───
806827
log ""
807828
log "$(msg section.user)"
808829
prompt ADMIN_USERNAME "Admin username" "admin"
809-
prompt ADMIN_PASSWORD "Admin password" "admin"
830+
prompt ADMIN_PASSWORD "Admin password" "${ADMIN_PASSWORD:-}"
810831
prompt FRONT_USERNAME "Developer username" "user"
811-
prompt FRONT_PASSWORD "Developer password" "123456"
832+
prompt FRONT_PASSWORD "Developer password" "${FRONT_PASSWORD:-}"
812833

813834
log ""
814835
log "$(msg section.storage)"

0 commit comments

Comments
 (0)