Commit Graph

8 Commits

Author SHA1 Message Date
hailin 747e4ae8ef refactor(mpc-system): migrate to party-driven architecture with PartyID-based routing
- Remove Address field from PartyEndpoint (parties connect to router themselves)
- Update K8s Discovery to only manage PartyID and Role labels
- Add Party registration and SessionEvent protobuf definitions
- Implement PartyRegistry and SessionEventBroadcaster domain logic
- Add RegisterParty and SubscribeSessionEvents gRPC handlers
- Prepare infrastructure for party-driven MPC coordination

This is the first phase of migrating from coordinator-driven to party-driven
architecture following international MPC system design patterns.
2025-12-05 08:11:28 -08:00
hailin a72b5f00d2 fix(api-gateway): update Nginx reverse proxy headers for Grafana 10+ compatibility
- Change Host header from $host to $http_host for correct host forwarding
- Add X-Forwarded-Host and X-Forwarded-Port headers
- Add Origin header ($scheme://$host) critical for Grafana 10+ CORS validation
- Disable proxy buffering for better real-time updates
- Update README with manual Nginx configuration update instructions for existing installations

Resolves 'origin not allowed' error when accessing Grafana through Nginx reverse proxy with SSL.
2025-12-04 22:31:59 -08:00
hailin 746cd8e35e fix(api-gateway): add Grafana 10+ CORS configuration for reverse proxy access
添加 Grafana 10+ 的 CORS/跨域配置,解决通过 Nginx 反向代理访问时的 "origin not allowed" 错误。

Changes:
- docker-compose.monitoring.yml: 添加 Grafana 安全配置
  - GF_SECURITY_ALLOW_EMBEDDING=true: 允许嵌入和反向代理访问
  - GF_SECURITY_COOKIE_SAMESITE=none: 允许跨域 Cookie
  - GF_SECURITY_COOKIE_SECURE=true: HTTPS 下安全传输 Cookie
  - GF_AUTH_ANONYMOUS_ENABLED=false: 保持安全性,禁用匿名访问

- .env.example: 添加重启提示说明
  - 强调修改 GRAFANA_ROOT_URL 后必须重启监控服务

- README.md: 新增 "Grafana 通过 Nginx/域名访问配置" 章节
  - 详细说明配置步骤
  - 提供验证方法
  - 列出常见错误和解决方案

问题根因:
Grafana 10+ 引入了更严格的安全策略,要求显式配置 CORS 相关参数才能通过反向代理访问。
仅配置 GF_SERVER_ROOT_URL 不足以解决跨域问题。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-04 22:23:04 -08:00
hailin a748cf07f0 docs(api-gateway): clarify Kong database configuration details
- Added Kong database configuration section to README.md
- Documented that Kong database username and database name are hardcoded as 'kong'
- Clarified that only password is configurable via KONG_PG_PASSWORD
- Added security warnings about changing password in production
- Updated .env.example with detailed comments about Kong database config

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-04 21:53:10 -08:00
hailin 2556fea841 refactor: separate configuration from code following 12-Factor App principles
- Created .env.example files with comprehensive security warnings
- Removed hardcoded IP addresses and credentials from docker-compose files
- Made database passwords mandatory (fail-fast on missing config)
- Removed Chinese mirror sources from all Dockerfiles
- Enhanced deploy.sh scripts with .env validation and auto-creation
- Added comprehensive README.md deployment guides
- Changed ALLOWED_IPS default to enable cross-server deployment
- Updated all docker-compose files to use environment variables

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-04 21:46:35 -08:00
Developer edb8134414 feat(api-gateway): 支持分布式部署 Kong 和后端服务分离
- 修改 kong.yml 使用外部 IP (192.168.1.111) 访问后端服务
- 修改 docker-compose.yml 使用独立网络,移除外部网络依赖
- 修改 deploy.sh 改为检查后端服务器连通性
- 更新 README 添加分布式部署架构图和详细部署流程

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 00:50:22 -08:00
Developer de2e2d0428 refactor(api-gateway): 将 Kong 独立为解耦模块
- 将 Kong 从 services/docker-compose.yml 移到 api-gateway/docker-compose.yml
- 添加 api-gateway/deploy.sh 一键部署脚本
- 完善 api-gateway/README.md 文档,包含完整架构图和部署流程
- Kong 使用外部网络连接 services,实现解耦部署

架构变更:
- services: 只包含微服务,不依赖 Kong
- api-gateway: 独立的 Kong 网关,可选部署

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 00:38:49 -08:00
Developer 7d9d5eeffe feat(api-gateway): 添加 Kong API 网关和 Nginx 配置
- 添加 Kong 声明式配置 (kong.yml),定义所有微服务路由
- 更新 docker-compose.yml 添加 Kong 服务 (kong-db, kong-migrations, kong)
- 添加 rwaapi.szaiai.com Nginx 配置 (SSL + 反向代理到 Kong)
- 添加 nginx/install.sh 一键安装脚本
- 添加 API Gateway README 文档

架构: 用户 → Nginx (SSL) → Kong (API Gateway) → 各微服务

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-03 00:33:22 -08:00