zhijiayun-pharmacy/zhijiayun-gateway/src/main/resources/application-prod.yml

# ========================================
# 生产环境配置
# 启动方式：-Dspring.profiles.active=prod
# 敏感配置优先通过环境变量覆盖，未设置时使用与测试环境一致的默认值
# ========================================

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://${DB_HOST:localhost}:${DB_PORT:3306}/${DB_NAME:zhijiayun_pharmacy}?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
    username: ${DB_USERNAME:user}
    password: ${DB_PASSWORD:qPa5*gt8o.}
    hikari:
      minimum-idle: 10
      maximum-pool-size: 50
      idle-timeout: 600000
      max-lifetime: 1800000
      connection-timeout: 30000
      pool-name: ZhijiayunHikariPool-Prod

  data:
    redis:
      host: ${REDIS_HOST:localhost}
      port: ${REDIS_PORT:6379}
      password: ${REDIS_PASSWORD:123456}
      database: ${REDIS_DATABASE:0}
      timeout: 5000ms
      lettuce:
        pool:
          max-active: 32
          max-idle: 16
          min-idle: 4
          max-wait: 3000ms

  # 生产环境禁止自动执行 schema（由 DBA 手动维护）
  sql:
    init:
      mode: never

# JWT 密钥：生产部署时通过环境变量覆盖
jwt:
  secret: ${JWT_SECRET:YourSuperSecretKeyForJWTTokenGenerationMustBeAtLeast256BitsLong!!}
  user-expiration: 3600000         # 1小时（毫秒）
  admin-expiration: 43200000       # 12小时（毫秒）
  miniapp-expiration: 2592000000   # 小程序 30天（毫秒）
  expiration: 300000
  refresh-expiration: 604800000

# 微信配置：生产部署时通过环境变量覆盖
wechat:
  # 微信开放平台（网站扫码登录）
  open:
    app-id: ${WECHAT_APP_ID:wxd5f6a9d072f9a9f0}
    app-secret: ${WECHAT_APP_SECRET:67d696a9f0a9d072f9a9f0d5f6a9d072}
    qr-connect:
      redirect-uri: ${WECHAT_REDIRECT_URI:https://priceapi.kailin.com.cn/api/auth/wechat/callback}
      scope: snsapi_login

# 阿里云短信：生产部署时通过环境变量覆盖
sms:
  test-mode: true
  test-code: "123456"
  access-key-id: ${ALIBABA_CLOUD_ACCESS_KEY_ID:LTAI5tDwjfteBvivYN41r8sJ}
  access-key-secret: ${ALIBABA_CLOUD_ACCESS_KEY_SECRET:yowuOGi2nYYnrqGpO3qcz94C4brcPp}
  sign-name: ${SMS_SIGN_NAME:开邻}
  template-code: ${SMS_TEMPLATE_CODE:SMS_483305249}
  code-length: 6
  expire-minutes: 5
  endpoint: dysmsapi.aliyuncs.com

# 阿里云OSS配置（生产环境）
oss:
  endpoint: ${OSS_ENDPOINT:oss-cn-shenzhen.aliyuncs.com}
  access-key-id: ${ALIBABA_CLOUD_ACCESS_KEY_ID:LTAI5tDwjfteBvivYN41r8sJ}
  access-key-secret: ${ALIBABA_CLOUD_ACCESS_KEY_SECRET:yowuOGi2nYYnrqGpO3qcz94C4brcPp}
  bucket-name: ${OSS_BUCKET_NAME:kailin-saas}
  base-path: ${OSS_BASE_PATH:uploads/}
  url-prefix: ${OSS_URL_PREFIX:}

# 生产环境日志：只记录 warn 及以上，减少性能开销
logging:
  level:
    com.xuekairui: info
    com.xuekairui.user.mapper: info    # 关闭 MyBatis SQL 调试日志（避免敏感参数泄露及性能损耗）
    org.springframework.security: warn
    com.zaxxer.hikari: warn
  file:
    name: /var/log/zhijiayun-pharmacy/zhijiayun-pharmacy.log

# 生产网关：更严格的限流
gateway:
  logging:
    enabled: true
    slow-threshold: 500
    exclude-paths:
      - /actuator/health
      - /favicon.ico
  rate-limit:
    enabled: true
    default-limit: 120
    default-window: 60
    rules:
      - path-prefixes:
          - /api/auth/sms
        limit: 10
      - path-prefixes:
          - /api/auth/login
        limit: 30

# 邀请码配置
invite:
  base-url: ${INVITE_BASE_URL:https://priceapi.kailin.com.cn}
  # 补填邀请码有效窗口（天），注册后30天内可补填
  bind-window-days: ${INVITE_BIND_WINDOW_DAYS:30}
  # 客户端安装包本地存储目录（流式下载）
  download-base-path: ${INVITE_DOWNLOAD_BASE_PATH:/desktop-updates}
  windows-filename: ${INVITE_WINDOWS_FILENAME:智价云-x64.exe}
  mac-filename: ${INVITE_MAC_FILENAME:智价云-arm64.dmg}

# 支付模块（生产环境必须设为 false）
payment:
  mock: false
  order-expire-minutes: 15
  # 支付宝（生产环境）：将生产证书文件复制到 certs/prod/alipay/ 或通过环境变量覆盖
  # 支付宝（开发/测试环境）：将沙箱证书文件复制到 certs/dev/alipay/ 目录下
  alipay:
    app-id: ${ALIPAY_APP_ID:2021005187690877}
    notify-url: ${ALIPAY_NOTIFY_URL:https://priceapi.kailin.com.cn/api/payment/callback/alipay}
    return-url: ${ALIPAY_RETURN_URL:http:https://priceapi.kailin.com.cn/payment/success}
    server-url: ${ALIPAY_SERVER_URL:https://openapi.alipay.com/gateway.do}
    # 公钥模式（优先）：配置了 alipay-public-key 即走公钥模式
    app-private-key: ${ALIPAY_APP_PRIVATE_KEY:}
    alipay-public-key: ${ALIPAY_PUBLIC_KEY:}
    # 证书模式（备选）：未配置 alipay-public-key 时回退到证书模式，从 certs/prod/alipay/ 读取
    app-private-key-path: ${ALIPAY_APP_PRIVATE_KEY_PATH:certs/prod/alipay/appPrivateKey.txt}
    app-cert-path: ${ALIPAY_APP_CERT_PATH:certs/prod/alipay/appCertPublicKey_2021005187690877.crt}
    alipay-cert-path: ${ALIPAY_CERT_PATH:certs/prod/alipay/alipayCertPublicKey_RSA2.crt}
    alipay-root-cert-path: ${ALIPAY_ROOT_CERT_PATH:certs/prod/alipay/alipayRootCert.crt}
  # 安心付（周期卡-小程序会员卡管理）：独立小程序应用，与网页应用的 alipay 配置完全独立
  anxin-alipay:
    enabled: false
    app-id: ${ALIPAY_ANXIN_APP_ID:}
    app-private-key: ${ALIPAY_ANXIN_APP_PRIVATE_KEY:}
    alipay-public-key: ${ALIPAY_ANXIN_PUBLIC_KEY:}
    notify-url: ${ALIPAY_ANXIN_NOTIFY_URL:https://priceapi.kailin.com.cn/api/payment/anxin/notify/deduct}
    card-notify-url: ${ALIPAY_ANXIN_CARD_NOTIFY_URL:https://priceapi.kailin.com.cn/api/payment/anxin/notify/card-change}
    server-url: https://openapi.alipay.com/gateway.do
    format: json
    charset: UTF-8
    sign-type: RSA2
  # 微信支付（生产环境）：将生产证书文件复制到 certs/prod/wechat/ 目录下
  wechat:
    app-id: ${WECHAT_PAY_APP_ID:wx24a9669e84ba1f0b}
    mch-id: ${WECHAT_PAY_MCH_ID:1612111355}
    api-v3-key: ${WECHAT_PAY_API_V3_KEY:iD1xB1mH6zO7pP2wD1rU4aD2nH7oL2lN}
    # 三份证书文件（从微信支付商户平台下载，放入 certs/prod/wechat/）：
    private-key-path: ${WECHAT_PAY_PRIVATE_KEY_PATH:certs/prod/wechat/apiclient_key.pem}         # 证书密钥pem（商户私钥）
    private-cert-path: ${WECHAT_PAY_PRIVATE_CERT_PATH:certs/prod/wechat/apiclient_cert.pem}      # 证书pem格式（商户证书）
    key-path: ${WECHAT_PAY_KEY_PATH:certs/prod/wechat/apiclient_cert.p12}                        # 证书pkcs12格式（密码默认为商户号）
    serial-no: ${WECHAT_PAY_SERIAL_NO:68E43B250D73977F1DC0E0D0827AF25A8BFB1777}
    # 微信支付公钥（新商户必须配置，从商户平台 → 账户中心 → API安全 → 申请微信支付公钥）
    public-key-path: ${WECHAT_PAY_PUBLIC_KEY_PATH:certs/prod/wechat/pub_key.pem}              # 微信支付公钥文件
    public-key-id: ${WECHAT_PAY_PUBLIC_KEY_ID:}                                              # 微信支付公钥ID
    notify-url: ${WECHAT_PAY_NOTIFY_URL:https://priceapi.kailin.com.cn/api/payment/callback/wechat}
  # 微信小程序支付（JSAPI 调起支付签名 appId）
  # 小程序 JSAPI 下单签名的 appId 必须为小程序自身的 appId，与 Native 扫码的 appId 区分
  # 不配置时自动回退到 payment.wechat.app-id（当两者相同时可省略）
  miniapp:
    app-id: ${WECHAT_PAY_MINIAPP_APP_ID:wx246605ec671bf08d}
    app-secret: ${WECHAT_PAY_MINIAPP_APP_SECRET:5dfa6b60f10347ffa7b959658b3f2496}