From 04f0802ba0a0e65334ad77e3d17718f53fdd7bc0 Mon Sep 17 00:00:00 2001
From: zhizhijie <zhizhijie@users.noreply.gitee.com>
Date: 星期六, 26 九月 2026 12:17:26 +0800
Subject: [PATCH] chore(配置安全): 进 jar 的配置改为纯占位符/环境变量，本机真实值移至 gitignore 的 config/application.yml；部署说明补密钥分层与轮换步骤 + 测试报告与日结
---
.gitignore | 1
docs/打包部署说明.md | 35 +++++++++++++++++
docs/工作日结/工作日结_2026-09-26.md | 38 +++++++++++++++++++
docs/功能测试报告/功能测试报告_密钥外部化与打包去密_2026-09-26.md | 46 +++++++++++++++++++++++
4 files changed, 120 insertions(+), 0 deletions(-)
diff --git a/.gitignore b/.gitignore
index 2c47c02..14f4624 100644
--- a/.gitignore
+++ b/.gitignore
@@ -103,3 +103,4 @@
_tmp_codexhome/
# Codex 搴旂敤鍦ㄦ湰浠撳簱鏍圭洰褰曚骇鐢熺殑浜х墿鐩綍锛堜繚鐣欏湪鏈湴锛屼笉鍏ュ簱锛�
outputs/
+traffic-audit-server/config/application.yml
diff --git "a/docs/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212_\345\257\206\351\222\245\345\244\226\351\203\250\345\214\226\344\270\216\346\211\223\345\214\205\345\216\273\345\257\206_2026-09-26.md" "b/docs/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212_\345\257\206\351\222\245\345\244\226\351\203\250\345\214\226\344\270\216\346\211\223\345\214\205\345\216\273\345\257\206_2026-09-26.md"
new file mode 100644
index 0000000..1373345
--- /dev/null
+++ "b/docs/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212/\345\212\237\350\203\275\346\265\213\350\257\225\346\212\245\345\221\212_\345\257\206\351\222\245\345\244\226\351\203\250\345\214\226\344\270\216\346\211\223\345\214\205\345\216\273\345\257\206_2026-09-26.md"
@@ -0,0 +1,46 @@
+# 鍔熻兘娴嬭瘯鎶ュ憡锛氬瘑閽ュ閮ㄥ寲涓庢墦鍖呭幓瀵嗭紙2026-09-26锛�
+
+> 鏃ユ湡锛�2026-09-26銆�妯″潡锛氶厤缃�/鎵撳寘锛坱raffic-audit-server 閰嶇疆鍒嗗眰 + .gitignore + 閮ㄧ讲璇存槑锛夈��娴嬭瘯浜猴細Codex
+> 璧峰洜锛氭鏌ラ儴缃插寘 `E:\璇曢獙\traffic-audit-deploy-20260913` 鏃跺彂鐜扳�斺�斿灞� `backend/application.yml` 鏄共鍑�鐨勫崰浣嶇増锛屼絾 **jar 鍐呯疆鐨� `BOOT-INF/classes/application.yml` 閲屽甫鐫�鐪熷疄瀵嗛挜**锛圖eepSeek API key銆佹湰鏈烘暟鎹簱鍙ｄ护銆丣WT 瀵嗛挜锛夈��
+
+## 涓�銆佸姛鑳借鏄庯紙鏀瑰姩锛�
+
+1. **杩� jar 鐨勯厤缃竴寰嬪崰浣嶇**锛歚traffic-audit-server/src/main/resources/application.yml`
+ - `spring.datasource.url: ${TRAFFIC_DB_URL:...}`銆乣username: ${TRAFFIC_DB_USER:root}`銆乣password: ${TRAFFIC_DB_PASSWORD:}`锛堥粯璁ょ┖锛�
+ - `jwt.secret: ${TRAFFIC_JWT_SECRET:traffic-audit-dev-jwt-secret-change-me}`
+ - `deepseek.api-key: ${DEEPSEEK_API_KEY:}`锛堥粯璁ょ┖锛�
+ 鈫� 鎵撳寘鍑虹殑 jar **涓嶅啀鍖呭惈浠讳綍鐪熷疄瀵嗛挜**銆�
+2. **鏈満寮�鍙戠殑鐪熷疄鍊煎崟鐙斁**锛氭柊寤� `traffic-audit-server/config/application.yml`锛堜繚瀛樻暟鎹簱鍙ｄ护銆丣WT銆丏eepSeek key锛夛紝
+ Spring Boot 榛樿鍔犺浇 `file:./config/application.yml`锛屼紭鍏堢骇楂樹簬 classpath 鐨勫悓鍚嶉厤缃� 鈫� 鏈満 `mvn spring-boot:run` 琛屼负涓嶅彉銆�
+ 璇ユ枃浠跺凡鍔犲叆 `.gitignore`锛堢 106 琛岋級锛�**鏃笉杩涗粨搴撱�佷篃涓嶈繘 jar**銆�
+3. **閮ㄧ讲璇存槑琛ュ厖**锛歚docs/鎵撳寘閮ㄧ讲璇存槑.md` 澧炲姞"瀵嗛挜涓庨厤缃�"涓�鑺傦紙鍚湇鍔″櫒涓婅疆鎹� key 鐨勬楠わ級銆�
+
+## 浜屻�佹祴璇曠幆澧�
+
+鍚庣 `mvn -q spring-boot:run -f traffic-audit-server/pom.xml`锛�8090锛夛紱MySQL 鏈満 `localhost:3308/traffic_audit`锛涜处鍙� admin/123456銆�
+
+## 涓夈�佺敤渚嬭〃
+
+| 缂栧彿 | 杈撳叆 | 棰勬湡 | 瀹為檯 | 缁撹 |
+| --- | --- | --- | --- | --- |
+| TC-1 | 鍚姩鍚庣锛堟湰鏈鸿鐩栨枃浠跺瓨鍦級 | 姝ｅ父鍚姩 | 鏃ュ織鍑虹幇 `Started TrafficAuditApplication` | 閫氳繃 |
+| TC-2 | `POST /api/auth/login`锛坅dmin/123456锛� | 搴撳彛浠ゅ彇鑷� `config/application.yml` | 鐧诲綍鎴愬姛銆佽繑鍥� token锛堣嫢瑕嗙洊鏂囦欢鏈敓鏁堬紝鍗犱綅绗﹂粯璁ょ┖鍙ｄ护浼氳繛涓嶄笂搴擄級 | 閫氳繃 |
+| TC-3 | `POST /api/llm/chat`锛�"鍙洖澶嶄袱涓瓧锛氭敹鍒�"锛� | DeepSeek key 鍙栬嚜 `config/application.yml` | HTTP 200銆佸洖绛�"鏀跺埌" | 閫氳繃 |
+| TC-4 | 杩� jar 鐨� `application.yml` 鍐呭 | 鏃犵湡瀹炲瘑閽� | 涓夊鍧囦负 `${...}` 鍗犱綅绗︼紙鍙ｄ护涓� api-key 榛樿绌猴級 | 閫氳繃 |
+| TC-5 | `git check-ignore` | 鏈満鐪熷疄閰嶇疆涓嶈繘搴� | `.gitignore:106 traffic-audit-server/config/application.yml` | 閫氳繃 |
+| TC-6 | `git grep -E "sk-[A-Za-z0-9]{16,}"` | 璺熻釜鏂囦欢閲屾棤瀵嗛挜 | 鏃犲懡涓紙鍙︼細09-23 鍓嶆牳鏌ヨ繃 git 鍘嗗彶涔熸棤鍛戒腑锛� | 閫氳繃 |
+| TC-7 | 浠撳簱鍐呬袱浠介儴缃叉ā鏉匡紙`deploy/.../backend/application.yml`銆乣_deploytest/application.yml`锛� | 鏃犵湡瀹炲瘑閽� | 鍧囦负銆岃鏀规垚浣犵殑鏁版嵁搴撳瘑鐮併��+ `api-key: ""` | 閫氳繃 |
+
+## 鍥涖�佸彂鐜扮殑闂涓庡缃�
+
+1. **jar 鍐呯疆閰嶇疆甯︾湡瀹炲瘑閽�**锛堟湰娆℃牴鍥狅級锛歋pring Boot 澶栭儴閰嶇疆浼樺厛绾ф洿楂橈紝鎵�浠ョ嚎涓婅繍琛屾椂鐢ㄧ殑鏄閮ㄥ�笺�佸姛鑳戒笂娌″彈褰卞搷锛涗絾 jar 鍙В鍘嬶紝鏄庢枃瀵嗛挜灏卞湪閲岄潰锛堜簩杩涘埗閲屾悳涓嶅埌 `sk-` 鏄洜涓鸿 zip 鍘嬬缉锛岃В鍘嬪嵆瑙侊級銆�
+ 鈫� 宸叉寜涓婅堪鏂规鏍规不锛�**浠ュ悗鎵撳寘涓嶄細鍐嶆妸瀵嗛挜鎵撹繘 jar**銆�
+2. **宸插甫鍑哄幓鐨勯偅浠� jar 鏃犳硶鏀跺洖**锛氶噷闈㈢殑 key 浠嶅湪銆傚缃缓璁紙蹇呴』鍋氾級锛�
+ - 鍒� DeepSeek 鎺у埗鍙�**鏂板缓涓�涓� key 骞跺垹闄ゆ棫鐨�**锛堟棫 key 绔嬪嵆澶辨晥锛宩ar 閲岀殑閭ｄ唤灏卞簾浜嗭級锛�
+ - 鍘婚偅鍙版湇鍔″櫒涓婃妸澶栭儴 `backend/application.yml` 鐨� `deepseek.api-key` 鎹㈡垚鏂� key锛堟垨鐩存帴鐣欑┖锛孉I 鍒嗘瀽灏变笉鐢級锛�
+ - 閲嶅惎鍚庣锛坄start-backend.cmd`锛夛紝鍦ㄩ〉闈㈢偣涓�娆� AI 鍒嗘瀽纭鍙敤銆�
+3. 鏈満鏁版嵁搴� root 鍙ｄ护鍚屾牱鍦ㄦ棫 jar 閲岋細鑻ラ偅鍙版湇鍔″櫒鐢ㄨ繃鍚屼竴鍙ｄ护锛屽缓璁竴骞舵敼鎺夛紙閮ㄧ讲妯℃澘鏈潵灏辫姹傜幇鍦烘敼锛夈��
+
+## 浜斻�佺粨璁�
+
+閰嶇疆鍒嗗眰鏀归�犲畬鎴愬苟閫氳繃 7 鏉＄敤渚嬶細杩� jar 鐨勫彧鏈夊崰浣嶇锛岀湡瀹炲�间粎瀛樺湪浜庢湰鏈烘湭璺熻釜鏂囦欢鎴栫幆澧冨彉閲忥紱鏈満寮�鍙戜笌绾夸笂閮ㄧ讲琛屼负鍧囨湭閫�鍖栥�傝疆鎹� key 鐨勬楠ゅ凡鍐欏叆閮ㄧ讲璇存槑銆�
diff --git "a/docs/\345\267\245\344\275\234\346\227\245\347\273\223/\345\267\245\344\275\234\346\227\245\347\273\223_2026-09-26.md" "b/docs/\345\267\245\344\275\234\346\227\245\347\273\223/\345\267\245\344\275\234\346\227\245\347\273\223_2026-09-26.md"
new file mode 100644
index 0000000..0df8a30
--- /dev/null
+++ "b/docs/\345\267\245\344\275\234\346\227\245\347\273\223/\345\267\245\344\275\234\346\227\245\347\273\223_2026-09-26.md"
@@ -0,0 +1,38 @@
+# 宸ヤ綔鏃ョ粨_2026-09-26
+
+## 涓�銆佷粖澶╁仛浜嗕粈涔�
+
+### 1. 妫�鏌ュ悓浜嬫渶杩戞彁浜や笌閮ㄧ讲鍖呭畨鍏�
+
+- 鍏徃 gitea `main` 涓庢湰鍦颁竴鑷达紙`ecf2b3c`锛夛紝09-24~09-26 鏃犳柊鎻愪氦锛涘悓浜嬫渶杩戜袱鏉℃槸 09-23 鐨� `e5faa88`銆乣3b68e9e`銆傛湇鍔″櫒瀹炰负 Gitblit锛堟棤鍙敤 REST API锛夛紝浠� `git ls-remote` 涓哄噯銆�
+- 妫�鏌� `E:\璇曢獙\traffic-audit-deploy-20260913`锛�
+ - 澶栧眰 `backend/application.yml` 閰嶇殑鏄� `127.0.0.1:3306/traffic_audit`銆乺oot銆佸瘑鐮佸崰浣嶇銆乣api-key: ""`锛堝共鍑�锛夛紱
+ - **浣� jar 鍐呯疆 `BOOT-INF/classes/application.yml` 甯︾湡瀹炲瘑閽�**锛圖eepSeek key銆佹湰鏈哄簱鍙ｄ护 3308/root/123456銆丣WT 瀵嗛挜锛夈��
+ - git 灞傞潰鏄共鍑�鐨勶細`application.yml` 涓� `_shots/` 閮借 gitignore锛宍git grep`/`git log -S` 鍧囨棤鍛戒腑銆�
+
+### 2. 閰嶇疆鍒嗗眰鏀归�狅紙鎵撳寘鍘诲瘑锛�
+
+- 杩� jar 鐨� `src/main/resources/application.yml` 鍏ㄩ儴鏀逛负鍗犱綅绗︼紙`${TRAFFIC_DB_*}`銆乣${DEEPSEEK_API_KEY:}`銆乣${TRAFFIC_JWT_SECRET:...}`锛夛紱
+- 鏈満鐪熷疄鍊肩Щ鍒� `traffic-audit-server/config/application.yml`锛圫pring 鐨� `file:./config/` 浼樺厛绾ф洿楂橈級锛屽苟鍔犲叆 `.gitignore`锛�
+- `docs/鎵撳寘閮ㄧ讲璇存槑.md` 澧炲姞"瀵嗛挜涓庨厤缃�"涓�鑺傦紙鍒嗗眰琛� + 鎵撳寘鍓嶈嚜鏌� + 閮ㄧ讲鏈烘崲 key + 杞崲姝ラ锛夈��
+
+### 3. 楠岃瘉
+
+- 鍚庣鍚姩 OK锛涚櫥褰曟垚鍔燂紙璇佹槑搴撳彛浠ゅ彇鑷湰鏈鸿鐩栨枃浠讹紝鍚﹀垯鍗犱綅绗︾┖鍙ｄ护杩炰笉涓婏級锛沗/api/llm/chat` 杩斿洖"鏀跺埌"锛堣瘉鏄� DeepSeek key 鍙栬嚜鏈満瑕嗙洊鏂囦欢锛夛紱
+- `git grep` 纭璺熻釜鏂囦欢涓棤 `sk-` 瀵嗛挜锛涗粨搴撳唴涓や唤閮ㄧ讲妯℃澘鍧囦负鍗犱綅鐗堛��
+
+## 浜屻�佹祴璇曠粨鏋滄憳瑕�
+
+- 鎶ュ憡锛歚docs/鍔熻兘娴嬭瘯鎶ュ憡/鍔熻兘娴嬭瘯鎶ュ憡_瀵嗛挜澶栭儴鍖栦笌鎵撳寘鍘诲瘑_2026-09-26.md`锛�7 鏉＄敤渚嬪叏閫氳繃锛夈��
+
+## 涓夈�侀仐鐣欓棶棰樹笌寰呭姙
+
+1. **銆愰渶鐢ㄦ埛鎿嶄綔銆戣疆鎹㈠凡娉勯湶鐨� DeepSeek key**锛氭帶鍒跺彴鏂板缓 key 鈫� 鍒犻櫎鏃� key 鈫� 閮ㄧ讲鏈哄閮� `application.yml` 濉柊 key 鈫� 閲嶅惎楠岃瘉銆傛棫 jar 鏃犳硶鏀跺洖锛岃疆鎹㈡槸鍞竴鏍规不鎵嬫銆�
+2. 鏈満鏁版嵁搴� root 鍙ｄ护锛�123456锛夊悓鏍峰湪鏃� jar 閲岋紝寤鸿閮ㄧ讲鏈烘崲鍙ｄ护銆�
+3. 涓嬫閲嶆柊鎵撳寘缁欓儴缃叉満鏃讹紝寤鸿鎸� `鎵撳寘閮ㄧ讲璇存槑.md` 鐨勮嚜鏌ユ楠ょ‘璁� jar 鍐呮棤鐪熷疄鍊硷紝骞堕『甯﹀悓姝ラ儴缃插寘鍐呯殑鏃ф瘝鐗堬紙P2-5锛夈��
+4. 椤圭洰鍏跺畠閬楃暀锛圥0/P1/P2锛夎 `docs/浜ゆ帴鏂囨。_2026-09-21.md` 绗� 4 鑺備笌 `docs/浜ゆ帴鏂囨。_2026-09-23.md`銆�
+
+## 鍥涖�佹槑澶╄鍒�
+
+1. 瑙嗙敤鎴峰畨鎺掓帹杩� P0锛氫嚎鍏冩姇璧勯」鐩寜鏈堣拷鍒楋紙P0-2锛夈�佸鍑哄墠鍩烘暟浣撴 + 缂哄け娓呭崟椤碉紙P0-3锛夈��2026-06/09 姣嶇増锛圥0-4锛夈��
+2. 姹囨�诲ぇ琛� 304 鏍笺��2025 绱鍒楀皯鍔� 7銆�8 鏈堛�嶆竻绌猴紙涓氬姟宸茬‘璁ゅ彛寰勶級銆�
diff --git "a/docs/\346\211\223\345\214\205\351\203\250\347\275\262\350\257\264\346\230\216.md" "b/docs/\346\211\223\345\214\205\351\203\250\347\275\262\350\257\264\346\230\216.md"
index 5d98f70..93b547b 100644
--- "a/docs/\346\211\223\345\214\205\351\203\250\347\275\262\350\257\264\346\230\216.md"
+++ "b/docs/\346\211\223\345\214\205\351\203\250\347\275\262\350\257\264\346\230\216.md"
@@ -219,3 +219,38 @@
- **2026-09-13**锛氭柊澧炰竴閿墦鍖呰剼鏈� `package-deploy.py`锛沯ar 鏀逛负鍐呭祵鍓嶇锛堥儴缃叉満涓嶅啀闇�瑕� nginx锛夛紱鍒犻櫎 Redis 鐩稿叧璇存槑锛堜唬鐮佹湭浣跨敤锛夛紱琛� `sql_wyc.sql` 涓� `summary.template-dir`锛涜ˉ `jwt.secret` 鍙栧�艰鍒欙紱琛ラ儴缃插悗楠岃瘉娓呭崟銆�
- 2026-08-27锛氶鐗堬紙zip 閮ㄧ讲鍖� + nginx 鏂规锛夈��
+
+---
+
+## 瀵嗛挜涓庨厤缃紙2026-09-26 璧凤紝鎵撳寘蹇呰锛�
+
+### 鍒嗗眰绾﹀畾
+
+| 浣嶇疆 | 鐢ㄩ�� | 鏄惁杩� git | 鏄惁杩� jar |
+| --- | --- | --- | --- |
+| `traffic-audit-server/src/main/resources/application.yml` | 杩� jar 鐨勯粯璁ら厤缃紝**鍙湁鍗犱綅绗�**锛坄${TRAFFIC_DB_PASSWORD:}`銆乣${DEEPSEEK_API_KEY:}` 绛夛級 | 鍚︼紙宸� gitignore锛岀敤 `application.yml.example` 鍋氭ā鏉匡級 | **鏄�**锛堟棤鐪熷疄鍊硷級 |
+| `traffic-audit-server/config/application.yml` | 鏈満寮�鍙戠湡瀹炲�硷紙搴撳彛浠� / JWT / DeepSeek key锛� | 鍚︼紙宸� gitignore锛� | 鍚� |
+| jar 鍚岀骇鐨� `backend/application.yml` | 閮ㄧ讲鏈虹湡瀹炲�硷紙浼樺厛绾ч珮浜� jar 鍐呯疆锛� | 鍚� | 鍚︼紙鍦ㄥ寘澶栵紝鐜板満濉級 |
+| 鐜鍙橀噺 `TRAFFIC_DB_PASSWORD` / `TRAFFIC_DB_USER` / `TRAFFIC_DB_URL` / `TRAFFIC_JWT_SECRET` / `DEEPSEEK_API_KEY` | 瑕嗙洊浠ヤ笂浠绘剰涓�椤� | 鍚� | 鍚� |
+
+### 鎵撳寘鍓嶈嚜鏌ワ紙30 绉掞級
+
+```powershell
+# 1) 纭杩� jar 鐨勯厤缃病鏈夌湡瀹炲瘑閽ワ紙搴斿彧鐪嬪埌 ${...}锛�
+Select-String -Path traffic-audit-server\src\main\resources\application.yml -Pattern "password:|api-key:|secret:"
+# 2) 鎵撳畬鍖呭悗鍐嶉獙璇佷竴娆� jar 鍐呴儴
+python -c "import zipfile;print(zipfile.ZipFile('traffic-audit-server/target/traffic-audit-server-1.0.0-SNAPSHOT.jar').read('BOOT-INF/classes/application.yml').decode('utf-8'))" | Select-String "password:|api-key:"
+```
+
+### 閮ㄧ讲鏈轰笂鍔�/鎹� DeepSeek key
+
+1. 鎵撳寘涓婁紶鍚庯紝缂栬緫 **jar 鍚岀骇**鐨� `backend/application.yml`锛歚deepseek.api-key: "浣犵殑鏂発ey"`锛堢暀绌哄垯椤甸潰 AI 鍒嗘瀽涓嶅彲鐢紝鍏朵綑鍔熻兘姝ｅ父锛夛紱
+2. 閲嶅惎鍚庣锛歚start-backend.cmd`锛堟垨 `java -jar traffic-audit-server-1.0.0-SNAPSHOT.jar`锛夛紱
+3. 椤甸潰閲岀偣涓�娆� AI 鍒嗘瀽纭鍙敤锛�
+4. **涓嶈**鍘绘敼 jar 鍐呴儴鐨勯厤缃紙鏀逛簡涓嬫鍙戝寘灏变涪锛夛紝涔熶笉瑕佹妸 key 鎻愪氦杩涗换浣曚粨搴撴枃浠躲��
+
+### 杞崲锛堜綔搴燂級宸叉硠闇茬殑 key
+
+1. 鐧诲綍 DeepSeek 鎺у埗鍙� 鈫� API Keys 鈫� 鏂板缓涓�涓� key锛�
+2. 鍒犻櫎/绂佺敤鏃� key锛堟棫 key 绔嬪埢澶辨晥锛屾鍓嶆墦鍖呭甫鍑哄幓鐨� jar 閲岄偅浠藉嵆浣滃簾锛夛紱
+3. 鎸変笂闈㈢ 1~3 姝ユ妸鏂� key 濉埌閮ㄧ讲鏈虹殑澶栭儴閰嶇疆骞堕噸鍚獙璇併��
--
Gitblit v1.9.1