Merge 58094265bb into 0b35d12b74

INSTALL.md

@@ -42,6 +42,9 @@ This is the fastest way to start a local environment with the main dependencies
 ```sh
 git clone https://github.com/rocboss/paopao-ce.git
 cd paopao-ce
+cp config.yaml.sample config.yaml
+openssl rand -hex 32
+# Set JWT.Secret in config.yaml to the generated value.
 docker compose up -d
 ```
 
@@ -54,11 +57,11 @@ The default compose setup starts these services:
 
 Notes:
 
-- The backend container mounts `./config.yaml.sample` as its runtime config by default.
+- The backend container mounts `./config.yaml` as its runtime config. Create it from the sample and set a unique `JWT.Secret` before starting the stack.
 - Persistent data is stored under `./custom/`.
 - Optional services such as MinIO, OpenObserve, Pyroscope, and phpMyAdmin are present in `docker-compose.yaml` but commented out by default.
 
-If you want to use a custom config file, replace the mounted file in `docker-compose.yaml`:
+The Compose file mounts the local config at `/app/paopao-ce/config.yaml`:
 
 ```yaml
 backend:
@@ -92,11 +95,13 @@ docker build -t your/paopao-ce:tag --build-arg EMBED_UI=no .
 
 Run a locally built image:
 
+Create `config.yaml` from the sample and set a unique `JWT.Secret` before running either backend image. Generate a value with `openssl rand -hex 32`.
+
 ```sh
 mkdir -p custom
 docker run -d -p 8008:8008 \
   -v ${PWD}/custom:/app/paopao-ce/custom \
-  -v ${PWD}/config.yaml.sample:/app/paopao-ce/config.yaml \
+  -v ${PWD}/config.yaml:/app/paopao-ce/config.yaml \
   your/paopao-ce:tag
 ```
 
@@ -106,7 +111,7 @@ Or use the published image:
 mkdir -p custom
 docker run -d -p 8008:8008 \
   -v ${PWD}/custom:/app/paopao-ce/custom \
-  -v ${PWD}/config.yaml.sample:/app/paopao-ce/config.yaml \
+  -v ${PWD}/config.yaml:/app/paopao-ce/config.yaml \
   bitbus/paopao-ce:latest
 ```
 
@@ -130,18 +135,22 @@ docker run -d -p 8010:80 your/paopao-ce:web
 
 ### All-in-one image
 
+Create `config.yaml` from `docker/config.yaml` and set a unique `JWT.Secret` before running either all-in-one image. Generate a value with `openssl rand -hex 32`.
+
 ```sh
 # Build
 docker buildx build --build-arg USE_DIST=yes -t your/paopao-ce:all-in-one-latest -f Dockerfile.allinone .
 
 # Run a local image
 docker run --name paopao-ce-allinone -d -p 8000:8008 -p 7700:7700 \
+  -v ${PWD}/config.yaml:/app/config.yaml \
   -v ./data/custom:/app/custom \
   -v ./data/meili_data:/app/meili_data \
   your/paopao-ce:all-in-one-latest
 
 # Run the published image
 docker run --name paopao-ce-allinone -d -p 8000:8008 -p 7700:7700 \
+  -v ${PWD}/config.yaml:/app/config.yaml \
   -v ./data/custom:/app/custom \
   -v ./data/meili_data:/app/meili_data \
   bitbus/paopao-ce:all-in-one-latest
@@ -156,8 +165,8 @@ If you mount a custom `config.yaml`, make sure `Meili.ApiKey` matches the contai
 ### Backend
 
 1. Initialize your database with the matching SQL file for your chosen database engine.
-2. Copy the configuration template.
+2. Copy the configuration template and set `JWT.Secret` to a unique value generated with `openssl rand -hex 32`.
-3. Adjust only the bootstrap-critical settings for your environment.
+3. Adjust the bootstrap-critical settings for your environment.
 4. Run or build the backend.
 
 ```sh

INSTALL_ZH.md

@@ -42,6 +42,9 @@
 ```sh
 git clone https://github.com/rocboss/paopao-ce.git
 cd paopao-ce
+cp config.yaml.sample config.yaml
+openssl rand -hex 32
+# 将生成的值填入 config.yaml 的 JWT.Secret。
 docker compose up -d
 ```
 
@@ -54,11 +57,11 @@ docker compose up -d
 
 说明：
 
-- 后端容器默认会将 `./config.yaml.sample` 挂载为运行配置。
+- 后端容器会将 `./config.yaml` 挂载为运行配置。启动前请从示例复制该文件，并设置唯一的 `JWT.Secret`。
 - 持久化数据默认保存在 `./custom/` 目录下。
 - `docker-compose.yaml` 中还预留了 MinIO、OpenObserve、Pyroscope、phpMyAdmin 等可选服务，但默认是注释状态。
 
-如果需要使用自定义配置文件，可将 `docker-compose.yaml` 中的挂载改为：
+Compose 配置会将本地配置挂载到 `/app/paopao-ce/config.yaml`：
 
 ```yaml
 backend:
@@ -92,11 +95,13 @@ docker build -t your/paopao-ce:tag --build-arg EMBED_UI=no .
 
 运行本地构建镜像：
 
+运行任一后端镜像前，请从示例创建 `config.yaml` 并设置唯一的 `JWT.Secret`。可使用 `openssl rand -hex 32` 生成。
+
 ```sh
 mkdir -p custom
 docker run -d -p 8008:8008 \
   -v ${PWD}/custom:/app/paopao-ce/custom \
-  -v ${PWD}/config.yaml.sample:/app/paopao-ce/config.yaml \
+  -v ${PWD}/config.yaml:/app/paopao-ce/config.yaml \
   your/paopao-ce:tag
 ```
 
@@ -106,7 +111,7 @@ docker run -d -p 8008:8008 \
 mkdir -p custom
 docker run -d -p 8008:8008 \
   -v ${PWD}/custom:/app/paopao-ce/custom \
-  -v ${PWD}/config.yaml.sample:/app/paopao-ce/config.yaml \
+  -v ${PWD}/config.yaml:/app/paopao-ce/config.yaml \
   bitbus/paopao-ce:latest
 ```
 
@@ -130,18 +135,22 @@ docker run -d -p 8010:80 your/paopao-ce:web
 
 ### All-in-one 镜像
 
+运行任一全合一镜像前，请从 `docker/config.yaml` 创建 `config.yaml` 并设置唯一的 `JWT.Secret`。可使用 `openssl rand -hex 32` 生成。
+
 ```sh
 # 构建
 docker buildx build --build-arg USE_DIST=yes -t your/paopao-ce:all-in-one-latest -f Dockerfile.allinone .
 
 # 运行本地镜像
 docker run --name paopao-ce-allinone -d -p 8000:8008 -p 7700:7700 \
+  -v ${PWD}/config.yaml:/app/config.yaml \
   -v ./data/custom:/app/custom \
   -v ./data/meili_data:/app/meili_data \
   your/paopao-ce:all-in-one-latest
 
 # 运行已发布镜像
 docker run --name paopao-ce-allinone -d -p 8000:8008 -p 7700:7700 \
+  -v ${PWD}/config.yaml:/app/config.yaml \
   -v ./data/custom:/app/custom \
   -v ./data/meili_data:/app/meili_data \
   bitbus/paopao-ce:all-in-one-latest
@@ -156,8 +165,8 @@ docker run --name paopao-ce-allinone -d -p 8000:8008 -p 7700:7700 \
 ### 后端
 
 1. 按照所选数据库导入对应 SQL 初始化脚本。
-2. 复制配置模板。
+2. 复制配置模板，将 `JWT.Secret` 设置为 `openssl rand -hex 32` 生成的唯一随机值。
-3. 只调整与你环境相关的启动关键配置。
+3. 调整与你环境相关的启动关键配置。
 4. 启动或构建后端。
 
 ```sh

README.md

@@ -93,6 +93,9 @@ This is the fastest way to bring up a local environment for evaluation.
 ```sh
 git clone https://github.com/rocboss/paopao-ce.git
 cd paopao-ce
+cp config.yaml.sample config.yaml
+openssl rand -hex 32
+# Set JWT.Secret in config.yaml to the generated value.
 docker compose up -d
 ```
 
@@ -116,7 +119,7 @@ Then open:
 #### Backend
 
 1. Import `scripts/paopao-mysql.sql` into MySQL.
-2. Copy the sample config and adjust only the bootstrap-critical values for your environment.
+2. Copy the sample config, set `JWT.Secret` to a unique value from `openssl rand -hex 32`, and adjust the bootstrap-critical values for your environment.
 3. Start the backend.
 
 ```sh

README_ZH.md

@@ -93,6 +93,9 @@ PaoPao 是一个完整的开源微社区系统，包含 Go 后端、Vue 3 Web
 ```sh
 git clone https://github.com/rocboss/paopao-ce.git
 cd paopao-ce
+cp config.yaml.sample config.yaml
+openssl rand -hex 32
+# 将生成的值填入 config.yaml 的 JWT.Secret。
 docker compose up -d
 ```
 
@@ -116,7 +119,7 @@ docker compose up -d
 #### 后端
 
 1. 将 `scripts/paopao-mysql.sql` 导入 MySQL。
-2. 复制示例配置，并只调整与你环境相关的启动关键项。
+2. 复制示例配置，将 `JWT.Secret` 设置为 `openssl rand -hex 32` 生成的唯一随机值，并调整与你环境相关的启动关键项。
 3. 启动后端服务。
 
 ```sh

config.yaml.sample

@@ -36,7 +36,7 @@ Redis:
     - redis:6379
 
 JWT:
-  Secret: 18a6413dc4fe394c66345ebe501b2f26
+  Secret: ""
   Issuer: paopao-api
   Expire: 86400
 

docker-compose.yaml

@@ -132,7 +132,7 @@ services:
       - meili
     # modify below to reflect your custom configure
     volumes:
-      - ./config.yaml.sample:/app/paopao-ce/config.yaml
+      - ./config.yaml:/app/paopao-ce/config.yaml
       - ./custom:/app/paopao-ce/custom
     ports:
       - 8008:8008

docker/config.yaml

@@ -31,7 +31,7 @@ Redis:
     - 127.0.0.1:6379
 
 JWT:
-  Secret: 18a6413dc4fe394c66345ebe501b2f26
+  Secret: ""
   Issuer: paopao-api
   Expire: 86400
 

docs/deploy/core/001-配置文件说明.md

@@ -3,7 +3,8 @@ paopao-ce使用YAML格式的`conf.yml`作为配置文件。[`config.yaml.sample`
 
 ```sh
 cp config.yaml.sample config.yaml
-vim config.yaml # 修改参数
+openssl rand -hex 32 # 生成唯一 JWT.Secret 并填入 config.yaml
+vim config.yaml # 修改其他参数
 paopao-ce
 ```