374 lines
24 KiB
YAML
374 lines
24 KiB
YAML
spring:
|
||
application:
|
||
# Spring 应用名；用于日志、注册中心标识等。
|
||
name: tms-framework
|
||
servlet:
|
||
multipart:
|
||
# Spring/Tomcat multipart 解析上限；必须不小于业务上传上限，否则请求会在进入 Controller 前被拒绝。
|
||
max-file-size: ${TMS_MULTIPART_MAX_FILE_SIZE_BYTES:524288000}
|
||
max-request-size: ${TMS_MULTIPART_MAX_REQUEST_SIZE_BYTES:536870912}
|
||
profiles:
|
||
# 默认激活环境；可通过 --spring.profiles.active=prod 覆盖。
|
||
active: dev
|
||
|
||
server:
|
||
# TMS HTTP 服务监听端口。
|
||
port: 8088
|
||
|
||
management:
|
||
endpoints:
|
||
web:
|
||
exposure:
|
||
# Actuator 对外暴露端点列表。
|
||
include: health,info,metrics
|
||
endpoint:
|
||
health:
|
||
# 健康检查返回详细信息策略：always/when-authorized/never。
|
||
show-details: always
|
||
|
||
springdoc:
|
||
api-docs:
|
||
# 是否启用 OpenAPI JSON 文档输出。
|
||
enabled: true
|
||
# OpenAPI 文档访问路径。
|
||
path: /v3/api-docs
|
||
swagger-ui:
|
||
# 是否启用 Swagger UI 页面。
|
||
enabled: true
|
||
# Swagger UI 页面路径。
|
||
path: /swagger-ui.html
|
||
# 标签排序方式（alpha: 字母序）。
|
||
tags-sorter: alpha
|
||
# 接口排序方式（alpha: 字母序）。
|
||
operations-sorter: alpha
|
||
|
||
tms:
|
||
file:
|
||
storage:
|
||
# 上传文件根目录；上传接口会将文件保存到 <upload-base-dir>/<fileId>/<originalFilename>。
|
||
upload-base-dir: ${TMS_FILE_STORAGE_UPLOAD_BASE_DIR:/home/tms/uploads}
|
||
# 上传文件大小上限（字节）。
|
||
max-file-size-bytes: ${TMS_FILE_STORAGE_MAX_FILE_SIZE_BYTES:524288000}
|
||
cert:
|
||
root-cert-source:
|
||
# 根证书来源校验：MAC 公钥 SM3 校验值文件。
|
||
public-key-sm3-path: ${TMS_CERT_ROOT_PUBLIC_KEY_SM3_PATH:/home/tms/device/dev.mac.pub.sm3}
|
||
# 根证书来源校验：用于验证 rootcert.sign 的 SM2 公钥文件。
|
||
public-key-path: ${TMS_CERT_ROOT_PUBLIC_KEY_PATH:/home/tms/device/dev.mac.pub}
|
||
# 根证书来源校验：根证书签名文件。
|
||
signature-path: ${TMS_CERT_ROOT_SIGNATURE_PATH:/home/tms/device/rootcert.sign}
|
||
crl:
|
||
# CRL 导入临时目录；原始文件只在解析过程中暂存，导入结束后删除。
|
||
temp-dir: ${TMS_CERT_CRL_TEMP_DIR:/home/tms/tmp/crl-import}
|
||
# CRL 文件大小上限，默认 500MiB。
|
||
max-file-size-bytes: ${TMS_CERT_CRL_MAX_FILE_SIZE_BYTES:524288000}
|
||
init:
|
||
executor:
|
||
# 初始化执行模式：SIMULATE(仅模拟，不执行外部命令) / LOCAL(本机执行脚本命令)。
|
||
mode: ${TMS_INIT_EXECUTOR_MODE:LOCAL}
|
||
# 单步骤命令超时时间（秒）。
|
||
timeout-sec: ${TMS_INIT_EXECUTOR_TIMEOUT_SEC:600}
|
||
# 初始化步骤日志目录；按 taskId/stepNo 生成日志文件。
|
||
log-dir: ${TMS_INIT_EXECUTOR_LOG_DIR:/home/tms/tmp/tms-init-logs}
|
||
# TMS 外置配置目录；资源备份恢复会按此目录收集配置。
|
||
tms-config-dir: ${TMS_INIT_EXECUTOR_TMS_CONFIG_DIR:/home/tms/config}
|
||
# 标准版（企业/间参）安装根目录统一变量。
|
||
standard-home-dir: ${TMS_INIT_STANDARD_HOME_DIR:/home/cmep4i}
|
||
# 标准版 cpconfig.cfg 路径；默认取 standard-home-dir 下文件。
|
||
standard-cpconfig-path: ${TMS_INIT_EXECUTOR_STANDARD_CPCONFIG_PATH:${tms.init.executor.standard-home-dir}/cpconfig.cfg}
|
||
# 标准版数据库脚本基目录；默认取 standard-home-dir/cpackage，用于读取 sql_script 模板。
|
||
standard-db-script-base-dir: ${TMS_INIT_EXECUTOR_STANDARD_DB_SCRIPT_BASE_DIR:${tms.init.executor.standard-home-dir}/cpackage}
|
||
# 标准版数据库 SQL 加载目录；DB_APPLY 会将渲染后 SQL 复制到该目录。
|
||
standard-db-load-dir: ${TMS_INIT_EXECUTOR_STANDARD_DB_LOAD_DIR:${tms.init.executor.standard-home-dir}/mysql/loadfilepath}
|
||
# 标准版数据库导库用户名；默认复用应用数据源账号。
|
||
standard-db-username: ${TMS_INIT_EXECUTOR_STANDARD_DB_USERNAME:root}
|
||
# 标准版数据库导库密码；默认复用应用数据源密码。
|
||
standard-db-password: ${TMS_INIT_EXECUTOR_STANDARD_DB_PASSWORD:Sunyard123}
|
||
# 标准版数据库导入命令；LOCAL 模式下必须配置，否则 DB_APPLY 会直接失败。
|
||
standard-db-apply-command: ${TMS_INIT_EXECUTOR_STANDARD_DB_APPLY_COMMAND:/home/tms/bin/apply_standard_db.sh}
|
||
# 标准版数据库入口 SQL 文件名；与导库命令配合使用。
|
||
standard-db-entry-sql-file-name: ${TMS_INIT_EXECUTOR_STANDARD_DB_ENTRY_SQL_FILE_NAME:CMEP.sql}
|
||
# 标准版 nginx 模板路径；用于生成最终 nginx.conf。
|
||
standard-nginx-template-path: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_TEMPLATE_PATH:${tms.init.executor.standard-home-dir}/cpackage/software/nginx.conf}
|
||
# 标准版 nginx 目标配置路径。
|
||
standard-nginx-target-path: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_TARGET_PATH:/usr/local/nginx/conf/nginx.conf}
|
||
# 标准版 WEB 前端压缩包路径；默认对齐厂商 cpackage/front/front.zip。
|
||
standard-web-front-zip-path: ${TMS_INIT_EXECUTOR_STANDARD_WEB_FRONT_ZIP_PATH:${tms.init.executor.standard-home-dir}/cpackage/front/front.zip}
|
||
# 标准版 WEB 工作目录；用于解压前端产物。
|
||
standard-web-work-dir: ${TMS_INIT_EXECUTOR_STANDARD_WEB_WORK_DIR:${tms.init.executor.standard-home-dir}/web}
|
||
# 标准版 WEB 发布目录。
|
||
standard-web-target-dir: ${TMS_INIT_EXECUTOR_STANDARD_WEB_TARGET_DIR:/usr/local/nginx/html}
|
||
# 标准版 organization.json 输出路径；默认对齐厂商脚本写入位置。
|
||
standard-web-organization-json-path: ${TMS_INIT_EXECUTOR_STANDARD_WEB_ORGANIZATION_JSON_PATH:${tms.init.executor.standard-web-target-dir}/organization.json}
|
||
# 标准版 CMSP/CMTP 启动用户；start_standard_apps.sh 会读取该值。
|
||
standard-run-user: ${TMS_INIT_EXECUTOR_STANDARD_RUN_USER:cmep4i}
|
||
# 标准版 CMSP/CMTP 启动命令；默认通过 root 受控 wrapper 执行，确保停启能跨用户处理 cmep4i 进程。
|
||
standard-app-start-command: ${TMS_INIT_EXECUTOR_STANDARD_APP_START_COMMAND:sudo -n /usr/local/sbin/tms-start-standard-apps}
|
||
# 标准版 CMSP/CMTP 停止命令；默认通过 root 受控 wrapper 执行，避免 tms 用户无权限 kill cmep4i 进程。
|
||
standard-app-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_APP_STOP_COMMAND:sudo -n /usr/local/sbin/tms-stop-standard-apps}
|
||
# 标准版 nginx 启动命令。
|
||
standard-nginx-start-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_START_COMMAND:sudo -n /usr/local/sbin/tms-start-standard-nginx}
|
||
# 标准版 nginx 停止命令。
|
||
standard-nginx-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_STOP_COMMAND:sudo -n /usr/local/sbin/tms-stop-standard-nginx}
|
||
# 标准版 RabbitMQ 停止命令。
|
||
standard-rabbit-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_STOP_COMMAND:/home/tms/bin/stop_standard_rabbitmq.sh}
|
||
# 标准版启动后检查命令。
|
||
standard-post-check-command: ${TMS_INIT_EXECUTOR_STANDARD_POST_CHECK_COMMAND:/home/tms/bin/check_standard_runtime.sh}
|
||
# 直参版 cpconfig 文件名（按 upload-base-dir/<cfgZipFileId>/<fileName> 解析）。
|
||
direct-cpconfig-file-name: ${TMS_INIT_EXECUTOR_DIRECT_CPCONFIG_FILE_NAME:cpconfig.cfg}
|
||
# 上传文件根目录；所有 fileId 均从该目录解析。
|
||
upload-base-dir: ${TMS_INIT_EXECUTOR_UPLOAD_BASE_DIR:/home/tms/uploads}
|
||
# 初始化过程临时暂存目录（用于复制上传文件后再处理）。
|
||
staging-root-dir: ${TMS_INIT_EXECUTOR_STAGING_ROOT_DIR:/home/tms/tmp/tms-init-staging}
|
||
# 标准版收发器 license 固定落位路径。
|
||
standard-receiver-license-target-path: ${TMS_INIT_EXECUTOR_STANDARD_RECEIVER_LICENSE_TARGET_PATH:${tms.init.executor.standard-home-dir}/cmep/license/cmep.license}
|
||
# 直参版收发器 license 固定落位路径。
|
||
direct-receiver-license-target-path: ${TMS_INIT_EXECUTOR_DIRECT_RECEIVER_LICENSE_TARGET_PATH:/home/cmep4d/cmep/license/cmep.license}
|
||
# 标准版 TLQ license（tlqconf.zip）落位路径。
|
||
standard-tlq-license-target-path: ${TMS_INIT_EXECUTOR_STANDARD_TLQ_LICENSE_TARGET_PATH:/home/tlq/tlqconf.zip}
|
||
# 直参版 TLQ license（license.dat）落位路径。
|
||
direct-tlq-license-target-path: ${TMS_INIT_EXECUTOR_DIRECT_TLQ_LICENSE_TARGET_PATH:/home/tlq/TLQ8/license.dat}
|
||
# 直参版执行 DB 脚本前，渲染后的 cpconfig.cfg 同步目标路径。
|
||
direct-cpconfig-target-path: ${TMS_INIT_EXECUTOR_DIRECT_CPCONFIG_TARGET_PATH:/opt/cpconfig.cfg}
|
||
# 直参版数据库初始化脚本目录（通常包含 setsql.sh）。
|
||
direct-db-script-dir: ${TMS_INIT_EXECUTOR_DIRECT_DB_SCRIPT_DIR:/opt/CAE_Install_Base_Resource/DB}
|
||
# 直参版 TLQ init_cfg.sh 所在目录。
|
||
direct-tlq-init-cfg-dir: ${TMS_INIT_EXECUTOR_DIRECT_TLQ_INIT_CFG_DIR:/opt/CAE_Install_App_Resource/CAE}
|
||
# CFMQ 配置落地目录；为空时仅校验文件，不执行复制。
|
||
cfmq-target-dir: ${TMS_INIT_EXECUTOR_CFMQ_TARGET_DIR:/pmts/cfg}
|
||
# RabbitMQ 管理员账号（预制）。
|
||
rabbit-admin-username: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_USERNAME:admin}
|
||
# RabbitMQ 管理员密码（预制）。
|
||
rabbit-admin-password: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_PASSWORD:admin}
|
||
# RabbitMQ 控制命令（用于新增用户、授权等）；默认通过 root 受控 wrapper 执行，避免 tms 与 RabbitMQ 服务端 Erlang cookie 不一致。
|
||
rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:sudo -n /usr/local/sbin/tms-rabbitmqctl}
|
||
# RabbitMQ Admin CLI 命令路径（用于创建队列等）。
|
||
rabbitmq-admin-command: ${TMS_INIT_EXECUTOR_RABBITMQ_ADMIN_COMMAND:/usr/sbin/rabbitmqadmin}
|
||
# 标准版 RabbitMQ 初始化脚本路径（保留兼容；MQ_USER_APPLY 当前优先直接调用 rabbitmqctl/rabbitmqadmin）。
|
||
standard-rabbit-setup-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_SETUP_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/setuprabq.sh}
|
||
# 标准版 RabbitMQ 队列初始化脚本（默认执行 01 节点脚本）。
|
||
standard-rabbit-queue-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_QUEUE_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/addrabq_R_01.sh}
|
||
# 标准版 RabbitMQ 队列初始化脚本（02 节点）；双节点时会按本机IP自动在01/02之间选择。
|
||
standard-rabbit-queue-script-path-02: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_QUEUE_SCRIPT_PATH_02:${tms.init.executor.standard-home-dir}/cpackage/rabq/addrabq_R_02.sh}
|
||
# 通道用户授权 vhost（默认 /RQ）。
|
||
rabbit-vhost: ${TMS_INIT_EXECUTOR_RABBIT_VHOST:/RQ}
|
||
# 标准版应用配置文件匹配规则；保留历史配置项，当前不再回写 RabbitMQ 通道账号密码。
|
||
standard-rabbit-app-config-patterns:
|
||
- ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_1:${tms.init.executor.standard-home-dir}/cmsp/application-prd*.properties}
|
||
- ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_2:${tms.init.executor.standard-home-dir}/cmtp/application-prd*.properties}
|
||
# 标准版 vendor 客户化脚本受控执行入口；该文件应由 root 部署到 /usr/local/sbin 且不可由 tms 写入。
|
||
standard-vendor-step-runner-command: ${TMS_INIT_EXECUTOR_STANDARD_VENDOR_STEP_RUNNER_COMMAND:/usr/local/sbin/tms-run-standard-vendor-step}
|
||
# 回写应用配置时，是否对 RabbitMQ 账号密码进行 3DES 加密。
|
||
standard-rabbit-credential-encrypt-enabled: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_ENCRYPT_ENABLED:true}
|
||
# 3DES 加密密钥（需与收发器解密逻辑保持一致）。
|
||
standard-rabbit-credential-secret-key: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_SECRET_KEY:ABCDEFGHIJKLMN1234567890}
|
||
# LOCAL 模式命令白名单前缀；非白名单命令会被拒绝执行。
|
||
whitelist-prefixes:
|
||
- ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_1:sudo -n ${tms.init.executor.standard-vendor-step-runner-command} }
|
||
- ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_2:bash /opt/CAE_Install_}
|
||
- ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_3:systemctl }
|
||
- ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_4:echo }
|
||
cisd:
|
||
preset:
|
||
# 设备预制版本：ENTERPRISE / INDIRECT / DIRECT。
|
||
product-type: ${TMS_CISD_PRESET_PRODUCT_TYPE:INDIRECT}
|
||
# 预制版本号（用于前端展示与任务记录）。
|
||
version: ${TMS_CISD_PRESET_VERSION:V1.0.0}
|
||
# 预制信息来源标识（CONFIG/DB 等自定义值）。
|
||
source: ${TMS_CISD_PRESET_SOURCE:CONFIG}
|
||
device:
|
||
profile:
|
||
# 设备型号展示值。
|
||
model: ${TMS_DEVICE_PROFILE_MODEL:SYD7108}
|
||
# 设备名称展示值。
|
||
name: ${TMS_DEVICE_PROFILE_NAME:跨境支付终端一体机}
|
||
# CPU 型号默认展示值；命令读取失败或为空时回退。
|
||
cpu-model-default: ${TMS_DEVICE_PROFILE_CPU_MODEL_DEFAULT:Hygon C86-3G (OPN:3350)}
|
||
# 内存总量默认展示值；命令读取失败或为空时回退。
|
||
memory-total-default: ${TMS_DEVICE_PROFILE_MEMORY_TOTAL_DEFAULT:16GB}
|
||
# 磁盘总量默认展示值；命令读取失败或为空时回退。
|
||
disk-total-default: ${TMS_DEVICE_PROFILE_DISK_TOTAL_DEFAULT:256G}
|
||
runtime-status:
|
||
# 运行状态磁盘已用量探测路径；总量使用 lsblk 统计 OS 可见物理磁盘容量。
|
||
disk-usage-path: ${TMS_DEVICE_RUNTIME_STATUS_DISK_USAGE_PATH:/home/tms}
|
||
upgrade:
|
||
# 升级包解压和脚本执行暂存目录。
|
||
staging-root-dir: ${TMS_UPGRADE_STAGING_ROOT_DIR:/home/tms/tmp/tms-upgrade-staging}
|
||
# 升级任务统一日志目录。
|
||
log-dir: ${TMS_UPGRADE_LOG_DIR:/home/tms/tmp/tms-upgrade-logs}
|
||
# 升级包验签使用的公钥 PEM 文件路径；为空时升级预检会拒绝通过。
|
||
signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/device/dev.mac.pub}
|
||
backup:
|
||
# 资源备份包输出目录；第一版先在本机生成可见的 .tmsbak 文件。
|
||
output-dir: ${TMS_BACKUP_OUTPUT_DIR:/home/tms/tmp/resource-backup-packages}
|
||
# 轻量恢复 apply 脚本启停 TMS 时使用的脚本路径。
|
||
tms-script-path: ${TMS_BACKUP_TMS_SCRIPT_PATH:/home/tms/scripts/tms.sh}
|
||
# 轻量恢复停服务命令。未配置时 apply 脚本会回退到 tms-script-path stop。
|
||
# command 支持现场脚本路径或完整 shell 命令；required=false 表示失败只记录 warning。
|
||
restore-stop-commands:
|
||
- code: STANDARD_NGINX
|
||
command: ${TMS_BACKUP_RESTORE_STOP_STANDARD_NGINX_COMMAND:${tms.init.executor.standard-nginx-stop-command}}
|
||
required: ${TMS_BACKUP_RESTORE_STOP_STANDARD_NGINX_REQUIRED:false}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
- code: STANDARD_APPS
|
||
command: ${TMS_BACKUP_RESTORE_STOP_STANDARD_APPS_COMMAND:${tms.init.executor.standard-app-stop-command}}
|
||
required: ${TMS_BACKUP_RESTORE_STOP_STANDARD_APPS_REQUIRED:false}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
- code: TMS
|
||
command: ${TMS_BACKUP_RESTORE_STOP_TMS_COMMAND:${tms.backup.tms-script-path} stop}
|
||
required: ${TMS_BACKUP_RESTORE_STOP_TMS_REQUIRED:false}
|
||
# 轻量恢复启动服务命令。标准/间参默认启动 TMS、CMSP/CMTP 和 nginx。
|
||
restore-start-commands:
|
||
- code: TMS
|
||
command: ${TMS_BACKUP_RESTORE_START_TMS_COMMAND:${tms.backup.tms-script-path} start}
|
||
required: ${TMS_BACKUP_RESTORE_START_TMS_REQUIRED:true}
|
||
- code: STANDARD_APPS
|
||
command: ${TMS_BACKUP_RESTORE_START_STANDARD_APPS_COMMAND:${tms.init.executor.standard-app-start-command}}
|
||
required: ${TMS_BACKUP_RESTORE_START_STANDARD_APPS_REQUIRED:true}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
- code: STANDARD_NGINX
|
||
command: ${TMS_BACKUP_RESTORE_START_STANDARD_NGINX_COMMAND:${tms.init.executor.standard-nginx-start-command}}
|
||
required: ${TMS_BACKUP_RESTORE_START_STANDARD_NGINX_REQUIRED:true}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
# 轻量恢复 apply 脚本路径；Java 完成验签/解密/展开后调用该脚本执行覆盖、SQL、MQ replay。
|
||
restore-apply-script-path: ${TMS_BACKUP_RESTORE_APPLY_SCRIPT_PATH:/home/tms/bin/resource-restore/apply-resource-backup.sh}
|
||
# 文件恢复白名单根路径；manifest 中 FILE 恢复路径必须落在这些目录下。
|
||
allowed-restore-roots:
|
||
- ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_TMS_CONFIG:/home/tms/config}
|
||
- ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_CMEP4I:/home/cmep4i}
|
||
- ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_CMEP4D:/home/cmep4d}
|
||
- ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_WORK:/home/tms/tmp/resource-restore}
|
||
# 现场可追加或覆盖直接复制恢复的文件类资源。
|
||
# mode=FILE 表示单文件，mode=DIR 表示目录递归，mode=GLOB 表示按通配符匹配同一目录下的一批文件。
|
||
# restore-path 对 FILE 是目标文件路径，对 DIR/GLOB 是目标目录；目标仍必须落在 allowed-restore-roots 下。
|
||
file-resources:
|
||
- code: TMS_CONFIG
|
||
mode: DIR
|
||
path: ${TMS_BACKUP_TMS_CONFIG_PATH:${tms.init.executor.tms-config-dir}}
|
||
restore-path: ${TMS_BACKUP_TMS_CONFIG_RESTORE_PATH:${tms.init.executor.tms-config-dir}}
|
||
required: ${TMS_BACKUP_TMS_CONFIG_REQUIRED:true}
|
||
- code: CP_CONFIG
|
||
mode: FILE
|
||
path: ${TMS_BACKUP_STANDARD_CP_CONFIG_PATH:${tms.init.executor.standard-cpconfig-path}}
|
||
restore-path: ${TMS_BACKUP_STANDARD_CP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-cpconfig-path}}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
required: ${TMS_BACKUP_STANDARD_CP_CONFIG_REQUIRED:true}
|
||
- code: CP_CONFIG
|
||
mode: FILE
|
||
path: ${TMS_BACKUP_DIRECT_CP_CONFIG_PATH:${tms.init.executor.direct-cpconfig-target-path}}
|
||
restore-path: ${TMS_BACKUP_DIRECT_CP_CONFIG_RESTORE_PATH:${tms.init.executor.direct-cpconfig-target-path}}
|
||
product-types:
|
||
- DIRECT
|
||
required: ${TMS_BACKUP_DIRECT_CP_CONFIG_REQUIRED:true}
|
||
- code: RECEIVER_LICENSE
|
||
mode: FILE
|
||
path: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_PATH:${tms.init.executor.standard-receiver-license-target-path}}
|
||
restore-path: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_RESTORE_PATH:${tms.init.executor.standard-receiver-license-target-path}}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
required: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_REQUIRED:true}
|
||
- code: RECEIVER_LICENSE
|
||
mode: FILE
|
||
path: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_PATH:${tms.init.executor.direct-receiver-license-target-path}}
|
||
restore-path: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_RESTORE_PATH:${tms.init.executor.direct-receiver-license-target-path}}
|
||
product-types:
|
||
- DIRECT
|
||
required: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_REQUIRED:true}
|
||
- code: STANDARD_CMSP_APP_CONFIG
|
||
mode: GLOB
|
||
path: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_PATH:${tms.init.executor.standard-home-dir}/cmsp/application-prd*.properties}
|
||
restore-path: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-home-dir}/cmsp}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
required: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_REQUIRED:true}
|
||
- code: STANDARD_CMTP_APP_CONFIG
|
||
mode: GLOB
|
||
path: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_PATH:${tms.init.executor.standard-home-dir}/cmtp/application-prd*.properties}
|
||
restore-path: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-home-dir}/cmtp}
|
||
product-types:
|
||
- ENTERPRISE
|
||
- INDIRECT
|
||
required: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_REQUIRED:true}
|
||
# 导出 TMS 库时使用的 mysqldump 命令；现场可按实际安装路径覆盖。
|
||
mysqldump-path: ${TMS_BACKUP_MYSQLDUMP_PATH:mysqldump}
|
||
# mysqldump 单次导出最大等待时间（秒）；超时会终止进程并将备份任务置为 FAILED。
|
||
mysqldump-timeout-seconds: ${TMS_BACKUP_MYSQLDUMP_TIMEOUT_SECONDS:300}
|
||
# 恢复 TMS 库时使用的 mysql 客户端命令。
|
||
mysql-path: ${TMS_BACKUP_MYSQL_PATH:mysql}
|
||
# 数据库恢复脚本路径；apply 脚本在 RESTORE_DATABASES 阶段调用。
|
||
restore-db-script-path: ${TMS_BACKUP_RESTORE_DB_SCRIPT_PATH:/home/tms/bin/resource-restore/restore-db.sh}
|
||
# 单个数据库恢复最大等待时间（秒）；超时会标记恢复失败并尝试重新启动服务。
|
||
restore-db-timeout-seconds: ${TMS_BACKUP_RESTORE_DB_TIMEOUT_SECONDS:300}
|
||
# MQ replay 脚本路径；apply 脚本在 MQ_REPLAY 阶段调用。
|
||
mq-replay-script-path: ${TMS_BACKUP_MQ_REPLAY_SCRIPT_PATH:/home/tms/bin/resource-restore/replay-mq.sh}
|
||
# 备份 TMS 库名；为空时默认从 spring.datasource.url 中解析。
|
||
tms-database-name: ${TMS_BACKUP_TMS_DATABASE_NAME:}
|
||
# TMS 库备份排除表。默认不备份角色、授权、会话和资源备份/恢复任务表，避免恢复时覆盖新机器安全登录状态或带回旧 RUNNING 任务。
|
||
tms-db-excluded-tables:
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_ACCOUNT:tms_role_account}
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_UKEY:tms_role_ukey_binding}
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_FULL:tms_auth_full_account}
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_SESSION:tms_auth_session}
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_BACKUP_TASK:tms_resource_backup_task}
|
||
- ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_RESTORE_TASK:tms_resource_restore_task}
|
||
# 备份/恢复标准收发器业务库名；第一版默认使用 CMEP。
|
||
cmep-database-name: ${TMS_BACKUP_CMEP_DATABASE_NAME:CMEP}
|
||
# 恢复完成后的最小健康检查地址。
|
||
health-check-url: ${TMS_BACKUP_HEALTH_CHECK_URL:http://127.0.0.1:8088/actuator/health}
|
||
# 健康检查请求超时（秒）。
|
||
health-check-timeout-seconds: ${TMS_BACKUP_HEALTH_CHECK_TIMEOUT_SECONDS:5}
|
||
# 健康检查最大等待时间（秒）；TMS 启动命令返回后，Spring Boot 仍可能需要一段时间才监听端口。
|
||
health-check-max-wait-seconds: ${TMS_BACKUP_HEALTH_CHECK_MAX_WAIT_SECONDS:180}
|
||
# 健康检查重试间隔（秒）。
|
||
health-check-retry-interval-seconds: ${TMS_BACKUP_HEALTH_CHECK_RETRY_INTERVAL_SECONDS:5}
|
||
mk:
|
||
init-identify:
|
||
# SDFE_InitIdentify 旧 PIN（Base64 编码）；主密钥初始化接口会读取该值。
|
||
old-pin-base64: ${TMS_MK_INIT_IDENTIFY_OLD_PIN_BASE64:NjY2NjY2}
|
||
# SDFE_InitIdentify 新 PIN（Base64 编码）；主密钥初始化接口会读取该值。
|
||
new-pin-base64: ${TMS_MK_INIT_IDENTIFY_NEW_PIN_BASE64:NjY2NjY2}
|
||
security:
|
||
# 内部接口鉴权 token（前后端内部调用需一致）。
|
||
internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token}
|
||
internal-auth:
|
||
# 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。
|
||
enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true}
|
||
# 关闭内部鉴权后，注入请求上下文的调试角色。
|
||
debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:KEY_ADMIN}
|
||
# 关闭内部鉴权后，注入请求上下文的调试认证等级。
|
||
debug-auth-level: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_AUTH_LEVEL:FULL}
|
||
# 关闭内部鉴权后，注入请求上下文的调试 session token。
|
||
debug-session-token: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_SESSION_TOKEN:DEBUG-BYPASS}
|
||
replay:
|
||
# 是否启用防重放校验；本地 Postman/联调可临时设为 false，生产环境应保持 true。
|
||
enabled: ${TMS_SECURITY_REPLAY_ENABLED:true}
|
||
openapi:
|
||
# 外部签名服务接口允许的时间戳偏差（秒），防重放。
|
||
timestamp-skew-seconds: 300
|
||
clients:
|
||
# 外部客户端 appId -> secret 映射（示例：demo-app）。
|
||
demo-app: ${TMS_OPENAPI_DEMO_SECRET:change-me-openapi-secret}
|
||
crypto-card:
|
||
# 是否启用密码卡能力。
|
||
enabled: ${TMS_CRYPTO_CARD_ENABLED:true}
|
||
# 密码卡模式：MOCK（模拟）/JNA（动态库调用）等。
|
||
mode: ${TMS_CRYPTO_CARD_MODE:JNA}
|
||
# 动态库目录（.so 所在目录）。
|
||
vendor-lib-path: ${TMS_CRYPTO_VENDOR_LIB_PATH:/home/tms/libs/libsdf_syd1408-x64.so.1.0.0}
|
||
# 动态库名（不含前缀/后缀或按加载器约定）。
|
||
vendor-lib-name: ${TMS_CRYPTO_VENDOR_LIB_NAME:sdf_ukey_syd1408}
|
||
# 是否严格校验算法标识（与 0018/厂商补充定义一致性校验）。
|
||
strict-alg-id-validation: ${TMS_CRYPTO_STRICT_ALG_ID_VALIDATION:true}
|