122 lines
4.8 KiB
YAML
122 lines
4.8 KiB
YAML
service_name: gateway-service
|
||
node_id: gateway-tencent
|
||
environment: prod
|
||
log:
|
||
level: info
|
||
format: json
|
||
include_request_body: false
|
||
include_response_body: false
|
||
max_payload_bytes: 2048
|
||
http_addr: ":13000"
|
||
cors:
|
||
# H5/Web Google 登录会先发 HTTPS preflight；gateway 必须在业务 handler 前返回 CORS 头。
|
||
enabled: true
|
||
allowed_origins:
|
||
- "https://global-interaction.com"
|
||
- "https://www.global-interaction.com"
|
||
- "https://api.global-interaction.com"
|
||
allowed_methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
|
||
allowed_headers:
|
||
- "Authorization"
|
||
- "Content-Type"
|
||
- "X-Request-ID"
|
||
- "X-App-Code"
|
||
- "X-HY-App-Code"
|
||
- "X-App-Package"
|
||
- "X-Package-Name"
|
||
- "X-App-Bundle-ID"
|
||
- "X-Bundle-ID"
|
||
- "X-App-Platform"
|
||
- "X-Platform"
|
||
expose_headers: ["X-Request-ID"]
|
||
allow_credentials: true
|
||
max_age_sec: 600
|
||
jwt_secret: "REPLACE_WITH_GATEWAY_JWT_SECRET"
|
||
room_service_addr: "room-service.internal:13001"
|
||
user_service_addr: "user-service.internal:13005"
|
||
wallet_service_addr: "wallet-service.internal:13004"
|
||
activity_service_addr: "activity-service.internal:13006"
|
||
game_service_addr: "game-service.internal:13008"
|
||
grpc_client:
|
||
# 线上通过内网 CLB/DNS 访问内部服务；重试只覆盖瞬时 UNAVAILABLE，避免放大业务副作用。
|
||
default_timeout: "5s"
|
||
connect_timeout: "2s"
|
||
keepalive_time: "30s"
|
||
keepalive_timeout: "10s"
|
||
retry_max_attempts: 2
|
||
retry_initial_backoff: "100ms"
|
||
retry_max_backoff: "500ms"
|
||
retry_backoff_multiplier: 2
|
||
retryable_status_codes: ["UNAVAILABLE"]
|
||
app_config:
|
||
# App 运行时配置由后台 APP配置写入 hyapp_admin，gateway 只读下发给 App。
|
||
mysql_dsn: "TENCENT_MYSQL_USER:TENCENT_MYSQL_PASSWORD@tcp(TENCENT_MYSQL_HOST:3306)/hyapp_admin?parseTime=true&charset=utf8mb4&loc=UTC"
|
||
leaderboard:
|
||
# 活动用户榜单只读钱包送礼事实；线上建议配置只读账号。
|
||
wallet_mysql_dsn: "TENCENT_MYSQL_USER:TENCENT_MYSQL_PASSWORD@tcp(TENCENT_MYSQL_HOST:3306)/hyapp_wallet?parseTime=true&charset=utf8mb4&loc=UTC"
|
||
auth_rate_limit:
|
||
# public auth 固定窗口频控；Redis 不可用时 gateway 启动失败，避免失去入口保护。
|
||
enabled: true
|
||
redis_addr: "TENCENT_REDIS_HOST:6379"
|
||
redis_password: "TENCENT_REDIS_PASSWORD"
|
||
redis_db: 0
|
||
key_prefix: "gateway:auth:rate:"
|
||
window_sec: 60
|
||
ip_limit: 120
|
||
device_id_limit: 30
|
||
provider_ip_limit: 20
|
||
display_user_id_ip_limit: 10
|
||
display_user_id_limit: 50
|
||
session_id_ip_limit: 30
|
||
login_risk:
|
||
enabled: true
|
||
redis_addr: "TENCENT_REDIS_HOST:6379"
|
||
redis_password: "TENCENT_REDIS_PASSWORD"
|
||
redis_db: 0
|
||
key_prefix: "login_risk:ip:"
|
||
fast_guard:
|
||
blocked_languages: []
|
||
blocked_language_primary_tags: []
|
||
blocked_timezones: []
|
||
blocked_timezone_prefixes: []
|
||
|
||
tencent_im:
|
||
# 腾讯云 IM 应用 ID，来自 Chat/IM 控制台的 SDKAppID。
|
||
sdk_app_id: 1400000000
|
||
# 腾讯云 IM SDKSecretKey，只允许保存在服务端密钥系统或线上配置中。
|
||
secret_key: "TENCENT_IM_SECRET_KEY"
|
||
# 腾讯云 IM App 管理员账号；必须和 activity/room 服务端 REST 配置一致。
|
||
admin_identifier: "TENCENT_IM_ADMIN_IDENTIFIER"
|
||
# 客户端 UserSig 有效期；过短会增加刷新频率，过长会放大泄露窗口。
|
||
user_sig_ttl: "24h"
|
||
# 腾讯云 IM 控制台配置的回调地址，用于入群前、发言前等业务守卫。
|
||
callback_url: "https://api.example.com/api/v1/tencent-im/callback"
|
||
# 腾讯云 IM 回调鉴权 Token，必须和控制台配置保持一致。
|
||
callback_auth_token: "TENCENT_IM_CALLBACK_AUTH_TOKEN"
|
||
|
||
tencent_rtc:
|
||
# 腾讯 RTC 应用 ID，来自 TRTC 控制台；可与 IM 相同，但必须显式配置。
|
||
enabled: true
|
||
sdk_app_id: 1400000000
|
||
# 腾讯 RTC SDKSecretKey，只允许保存在服务端密钥系统或线上配置中。
|
||
secret_key: "TENCENT_RTC_SECRET_KEY"
|
||
# RTC 进房票据有效期；按客户端刷新能力和泄露窗口调整。
|
||
user_sig_ttl: "2h"
|
||
# 当前业务 room_id 是字符串，客户端只能使用 TRTC strRoomId。
|
||
room_id_type: "string"
|
||
# 语音房场景固定使用 VoiceChatRoom，所有客户端必须保持一致。
|
||
app_scene: "voice_chat_room"
|
||
# 腾讯 RTC 控制台配置的事件回调地址，用于房间退出和音频发布状态同步。
|
||
callback_url: "https://api.example.com/api/v1/tencent-rtc/callback?app_code=default"
|
||
# 腾讯 RTC 回调签名 key，必须和控制台配置保持一致；不要复用 UserSig SecretKey。
|
||
callback_sign_key: "TENCENT_RTC_CALLBACK_SIGN_KEY"
|
||
|
||
tencent-cos:
|
||
# App 文件/头像上传使用腾讯云 COS；SecretID/SecretKey 只允许保存在服务端配置。
|
||
enabled: true
|
||
secret-id: "TENCENT_COS_SECRET_ID"
|
||
secret-key: "TENCENT_COS_SECRET_KEY"
|
||
bucket-name: "TENCENT_COS_BUCKET_NAME"
|
||
region: "TENCENT_COS_REGION"
|
||
access-url: "https://media.example.com"
|