From 34981c30a78e8bbd7791131059a9210f9928b62c Mon Sep 17 00:00:00 2001
From: 刘光辉 <347230014@qq.com>
Date: 星期四, 17 九月 2026 09:24:09 +0800
Subject: [PATCH] Merge remote-tracking branch 'origin/master' into master

---
 docker/postgres/migration/create-app-roles.sh |  116 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 116 insertions(+), 0 deletions(-)

diff --git a/docker/postgres/migration/create-app-roles.sh b/docker/postgres/migration/create-app-roles.sh
new file mode 100644
index 0000000..72500d0
--- /dev/null
+++ b/docker/postgres/migration/create-app-roles.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Backlog A4锛氬垱寤轰笟鍔′笓鐢ㄨ繛搴撹鑹诧紙jnpf_app / jnpf_flow_app / nacos_app锛夊苟绉讳氦瀛橀噺瀵硅薄鎵�鏈夋潈銆�
+# 骞傜瓑锛屽彲閲嶅鎵ц锛涘瘑鐮佸彇鑷粨搴撴牴 .env锛堥敭瑙佷笅锛夛紝鎵ц鍚庢寜 .env 閲嶇疆瑙掕壊瀵嗙爜銆�
+#
+# 鍓嶇疆锛氱洰鏍� PG 瀹瑰櫒鍦ㄨ窇
+#
+# 鍙傛暟锛堢幆澧冨彉閲忥級锛�
+#   CONTAINER   鐩爣 PG 瀹瑰櫒鍚嶏紝榛樿 cx-postgres
+#   ENV_FILE    鍑嵁鏂囦欢锛岄粯璁や粠鑴氭湰鐩綍鍚戜笂鎵剧涓�涓� .env
+#
+# 馃敶 鏈剼鏈細 ALTER ROLE ... PASSWORD 銆愰噸缃�戣鑹插瘑鐮併�傚瀹炰緥鏈哄櫒涓婅窇閿� CONTAINER
+#    锛濇妸鍙︿竴涓鎴风殑瀵嗙爜鏀规帀銆侀厤棰濇敼鎺夛紝涓氬姟褰撳満杩炰笉涓娿�傚紑璺戝墠蹇呯湅瀹冩墦鍗扮殑鐩爣瀹瑰櫒銆�
+# 鐢ㄦ硶锛�./docker/postgres/migration/create-app-roles.sh锛堜粨搴撴牴锛�
+#       鎴� migration/create-app-roles.sh锛堢绾夸氦浠樺寘鍐咃紝.env 鍦ㄥ寘鏍癸級
+#
+# 鎵ц鍚庣殑鑱斿姩锛堟墜宸ワ紝瑙� docs/release-checklist.md 搂0.3锛夛細
+#   1. config/shared/datasource.yaml锛歴pring.datasource.username/password 鈫� jnpf_app
+#   2. .env锛欽NPF_FLOW_DB_USER/PASSWORD 鈫� jnpf_flow_app锛汮NPF_NACOS_DB_USER/PASSWORD 鈫� nacos_app
+#   3. docker compose up -d锛堥噸寤� cx-flow-engine锛�+ 閲嶅惎涓氬姟鏈嶅姟
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# 鐩爣瀹瑰櫒锛氬瀹炰緥鏈哄櫒涓婂繀椤绘樉寮忎紶锛岄粯璁ゅ�煎彧涓哄吋瀹瑰崟瀹炰緥鐨勫巻鍙茶皟鐢�
+CONTAINER="${CONTAINER:-cx-postgres}"
+docker inspect "$CONTAINER" >/dev/null 2>&1 || { echo "閿欒锛氬鍣� $CONTAINER 涓嶅湪"; exit 1; }
+printf '\033[1;33m鐩爣 PG 瀹瑰櫒锛�%s\033[0m锛堟湰鑴氭湰浼氶噸缃瀹炰緥鐨勮鑹插瘑鐮佷笌杩炴帴閰嶉锛塡n' "$CONTAINER"
+
+# 鍑嵁鏂囦欢锛氫紭鍏� ENV_FILE 鏄惧紡鎸囧畾锛屽惁鍒欎粠鑴氭湰鐩綍鍚戜笂鎵剧涓�涓惈 .env 鐨勭洰褰曪紙浠撳簱鏍�/浜や粯鍖呮牴锛夈��
+#
+# ENV_FILE 鏄负澶氬鎴锋嫇鎵戝姞鐨勶紙docs/adr-multi-customer-db-isolation.md 搂8锛夛細涓�鍙版満鍣ㄤ笂璺戠潃澶氫釜
+# 瀹㈡埛鐨� PG 瀹炰緥锛岃�屽瘑鐮佷笌杩炴帴閰嶉鏄�愭寜瀹炰緥銆戜笉鍚岀殑銆傛病鏈夎繖涓紑鍏冲氨鍙兘"涓存椂鏀瑰叡浜� .env 鈫� 璺戣剼鏈�
+# 鈫� 璁板緱鏀瑰洖鏉�"锛屾紡鏀逛竴娆″氨浼氬湪涓嬫瀵瑰埆鐨勫疄渚嬭窇鏈剼鏈椂鎶婇偅涓鎴风殑瀵嗙爜鏀规垚杩欎釜瀹㈡埛鐨勩��
+# 鐢ㄦ硶锛欵NV_FILE=/home/ubuntu/jnpf-pg/.env.c2 CONTAINER=cx-pg-c2 ./create-app-roles.sh
+if [ -n "${ENV_FILE:-}" ]; then
+  [ -f "$ENV_FILE" ] || { echo "閿欒锛欵NV_FILE 鎸囧畾鐨� $ENV_FILE 涓嶅瓨鍦�"; exit 1; }
+  ENV_PATH="$ENV_FILE"
+else
+  ROOT=""; d="$SCRIPT_DIR"
+  while [ "$d" != "/" ]; do
+    if [ -f "$d/.env" ]; then ROOT="$d"; break; fi
+    d="$(dirname "$d")"
+  done
+  [ -n "$ROOT" ] || { echo "閿欒锛氬悜涓婃湭鎵惧埌 .env锛堝湪浠撳簱鏍�/浜や粯鍖呮牴 cp .env.example .env 骞跺畾绋垮悗閲嶈瘯锛孡030锛�"; exit 1; }
+  ENV_PATH="$ROOT/.env"
+fi
+echo "鍑嵁鏂囦欢锛�$ENV_PATH"
+
+# 鍙寜閿彇鍊硷紝涓� source锛�.env 鍙兘鍚换鎰忓瓧绗︼級銆�
+# `|| true` 涓嶅彲鐪侊細set -euo pipefail 涓� grep 鏃犲尮閰嶈繑鍥� 1锛岀粡 pipefail 浼犵粰鍛戒护鏇挎崲浼氫护璧嬪�煎け璐�
+# 骞惰 set -e 鐩存帴缁堟鑴氭湰鈥斺�斾笅闈㈤偅浜�"缂� XXX"鐨勫弸濂芥姤閿欏弽鑰屾案杩滆蛋涓嶅埌銆�
+envval() { grep -E "^$1=" "$ENV_PATH" | tail -1 | cut -d= -f2- || true; }
+
+APP_PW="$(envval JNPF_APP_DB_PASSWORD)"
+FLOW_PW="$(envval JNPF_FLOW_DB_PASSWORD)"
+NACOS_PW="$(envval JNPF_NACOS_DB_PASSWORD)"
+
+for pair in "JNPF_APP_DB_PASSWORD:${APP_PW}" "JNPF_FLOW_DB_PASSWORD:${FLOW_PW}"; do
+  [ -n "${pair#*:}" ] || { echo "閿欒锛�.env 缂� ${pair%%:*}锛堟ā鏉胯 .env.example锛�"; exit 1; }
+done
+
+# nacos_app锛氳ˉ涓� #8 鍚庢柊鏍堜笉鍐嶄娇鐢紝.env.example 宸蹭笉鍚� JNPF_NACOS_DB_PASSWORD銆�
+# 鍙湁杩愮淮鏄惧紡鍦� ${ENV_FILE:-.env} 閲岃缃閿紙鍏煎浠嶈窇鏃� Nacos 鏋舵瀯鐨勫疄渚嬶級鏃舵墠澶勭悊杩欎釜瑙掕壊锛�
+# 缂洪敭鏃朵笉褰撻敊璇鐞嗭紝鐩存帴璺宠繃锛屼笉璁稿洜姝ゆ姤閿欓��鍑恒��
+NACOS_ENABLED=false
+if [ -n "$NACOS_PW" ]; then
+  NACOS_ENABLED=true
+else
+  echo "璺宠繃 nacos_app锛堣ˉ涓� #8 鍚庢爤涓嶅啀浣跨敤锛涙棫瀹炰緥鍏煎闇�鑷璁� JNPF_NACOS_DB_PASSWORD锛�"
+fi
+
+# 杩炴帴鏁伴厤棰濓紙L029 绾垫繁闃插尽锛氶槻鍗曡鑹插崰婊¤繛鎺ユЫ楗挎娴佺▼寮曟搸绛夛級銆傜己鐪� = 姝ｅ紡/鍗曞鐜鎺ㄨ崘鍊硷紱
+# CVM 鍏变韩搴撳湪 .env 瑕嗙洊涓� 350/35/10銆傞搧寰嬶細涓夎�呬箣鍜岄』 < (max_connections 鈭� superuser_reserved)銆�
+APP_CONN_LIMIT="$(envval JNPF_APP_CONN_LIMIT)";     APP_CONN_LIMIT="${APP_CONN_LIMIT:-150}"
+FLOW_CONN_LIMIT="$(envval JNPF_FLOW_CONN_LIMIT)";   FLOW_CONN_LIMIT="${FLOW_CONN_LIMIT:-30}"
+NACOS_CONN_LIMIT="$(envval JNPF_NACOS_CONN_LIMIT)"; NACOS_CONN_LIMIT="${NACOS_CONN_LIMIT:-10}"
+
+# 鏍￠獙涓洪潪璐熸暣鏁帮紙psql -v 鐩存帴鍐呮彃杩� CONNECTION LIMIT锛岄潪鏁存暟浼氳嚧璇硶閿�/娉ㄥ叆锛�
+# nacos_app 鏈惎鐢ㄦ椂涓嶆牎楠屽叾閰嶉鈥斺�斾笉鍙備笌姹傚拰涔熶笉浼氳鐢ㄥ埌锛岄伩鍏嶉仐鐣欒剰鍊兼尅浣� app/flow 涓や釜瑙掕壊
+CONN_CHECK_PAIRS=("JNPF_APP_CONN_LIMIT:${APP_CONN_LIMIT}" "JNPF_FLOW_CONN_LIMIT:${FLOW_CONN_LIMIT}")
+[ "$NACOS_ENABLED" = true ] && CONN_CHECK_PAIRS+=("JNPF_NACOS_CONN_LIMIT:${NACOS_CONN_LIMIT}")
+for pair in "${CONN_CHECK_PAIRS[@]}"; do
+  case "${pair#*:}" in
+    ''|*[!0-9]*) echo "閿欒锛�${pair%%:*} 蹇呴』鏄潪璐熸暣鏁帮紝褰撳墠='${pair#*:}'锛�.env 鎴栨敼榛樿锛�"; exit 1;;
+  esac
+done
+
+# 鎻愮ず鏂囨鎸夊疄闄呭鐞嗙殑瑙掕壊鏁拌绠楋紙nacos_app 璺宠繃鏃朵笉璁″叆姹傚拰锛�
+if [ "$NACOS_ENABLED" = true ]; then
+  echo "杩炴帴閰嶉锛歫npf_app=${APP_CONN_LIMIT} / jnpf_flow_app=${FLOW_CONN_LIMIT} / nacos_app=${NACOS_CONN_LIMIT}锛堝拰=$((APP_CONN_LIMIT+FLOW_CONN_LIMIT+NACOS_CONN_LIMIT))锛岄』 < max_connections鈭�3锛�"
+else
+  echo "杩炴帴閰嶉锛歫npf_app=${APP_CONN_LIMIT} / jnpf_flow_app=${FLOW_CONN_LIMIT}锛堝拰=$((APP_CONN_LIMIT+FLOW_CONN_LIMIT))锛岄』 < max_connections鈭�3锛沶acos_app 宸茶烦杩囷紝涓嶈鍏ワ級"
+fi
+
+docker exec -i "$CONTAINER" psql -U postgres -d postgres \
+  -v ON_ERROR_STOP=1 \
+  -v nacos_enabled="${NACOS_ENABLED}" \
+  -v app_pw="${APP_PW}" \
+  -v flow_pw="${FLOW_PW}" \
+  -v nacos_pw="${NACOS_PW}" \
+  -v app_conn_limit="${APP_CONN_LIMIT}" \
+  -v flow_conn_limit="${FLOW_CONN_LIMIT}" \
+  -v nacos_conn_limit="${NACOS_CONN_LIMIT}" \
+  -f - < "$SCRIPT_DIR/create_app_roles.sql"
+
+echo
+echo "== 楠岃瘉锛氬悇瑙掕壊 TCP 杩炲悇鑷簱锛堝鍣� eth0 鍦板潃锛岃蛋 scram 鐪熼獙瀵嗙爜锛泂ocket/127.0.0.1 鏄� trust 楠屼笉鍑洪敊瀵嗙爜锛� =="
+PGIP=$(docker exec "$CONTAINER" hostname -i | awk '{print $1}')
+docker exec "$CONTAINER" psql "postgresql://jnpf_app:${APP_PW}@${PGIP}:5432/jnpf_init"        -Atc "SELECT 'jnpf_app鈫抝npf_init OK'"
+docker exec "$CONTAINER" psql "postgresql://jnpf_flow_app:${FLOW_PW}@${PGIP}:5432/jnpf_flow"  -Atc "SELECT 'jnpf_flow_app鈫抝npf_flow OK'"
+if [ "$NACOS_ENABLED" = true ]; then
+  docker exec "$CONTAINER" psql "postgresql://nacos_app:${NACOS_PW}@${PGIP}:5432/nacos_config"  -Atc "SELECT 'nacos_app鈫抧acos_config OK'"
+fi
+echo "== 楠岃瘉锛氳秺搴撳簲琚嫆锛堟湡鏈涙姤 permission denied锛� =="
+docker exec "$CONTAINER" psql "postgresql://jnpf_app:${APP_PW}@${PGIP}:5432/nacos_config" -Atc "SELECT 1" 2>&1 | head -1 || true
+echo "瀹屾垚 鉁�"

--
Gitblit v1.8.0