9d6ebbe422
NAS 局域网 IP 因重启被 DHCP 换过两次，磁盘/网络稳定性都不如已经跑着好几个 生产服务的甲骨文机器。整体搬迁：应用 + 数据库都搬走，NAS 只保留 Gitea（这个 仓库的源码托管，未动）。 ## 迁移过程（已核对无损） - MariaDB：NAS 导出（10.11 源库，处理了只有新版本才有的 `/*M!999999` 注释） → 导入甲骨文 MariaDB 10.3.39，**20 张表逐条精确 COUNT(*) 比对完全一致** - 冻结 NAS（停服务）后又 dump 一次核对，确认期间零数据差异，才继续删库 - NAS `garmin_health_lab` 已 DROP DATABASE，备份在本地 `~/Desktop/Work/backups/garmin_health_lab_nas_backup_20260912.sql.gz` - 应用部署到 `/opt/garmin-health-lab`，systemd 单元（`ubuntu` 用户，非 root），和这台机器上的 ai-gateway/auth-hub 同一套约定 - 公网：`https://garmin.zichuan.xyz`，DNS + Caddy 反代 + 自动 TLS，替代原来 `NAS frpc → 甲骨文:8124` 那条隧道（已从 NAS 的 frpc.toml 精确删除对应段， 其它转发未动，改完逐条复检过没打断） - auth-hub 回调地址换成新域名，NAS/旧端口那几条历史回调已清掉 - AI 网关配置改本地回环（网关现在同机了），触发真实生成验证过 ## 一个当场拦下来的风险 甲骨文部署完默认开着自动同步。迁移窗口期两边并行跑时，若两边的调度器同时去 刷新 Garmin 令牌，会撞上按账号计算的 SSO 限流（`GarminHealthLab` 仓库 2026-09-03 那次事故的根因，那次修复花了一整天）。确认账号级 auto_sync 设置 本来是关的、这次算侥幸没撞上——不是设计上的保险，所以迁移期间显式在甲骨文这边 加了 `AUTO_SYNC=false`，直接在运行进程里验证过生效，确认 NAS 已冻结、数据无 缺口后才打开。 ## 文档 / 脚本同步 CLAUDE.md 明确写过"部署位置会变，排障前先查、不要凭记忆"——这次是第二次踩中 同一类问题（上次是"NAS 有没有生产环境"判断错），所以把 CLAUDE.md / PROGRESS.md / README.md / docs/* 里的部署事实全部更新，NAS 时代的 `deploy/` 脚本加废弃 说明保留参考、不删除，新增 `deploy/push_oracle.sh`（当场跑通一次真实部署）。 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
67 lines
3.3 KiB
Python
67 lines
3.3 KiB
Python
"""
|
|
Central configuration for the Garmin Health Lab Flask backend.
|
|
|
|
Reads settings from a `.env` file (backend/.env) and the process environment.
|
|
The same code runs against SQLite (local dev) or MariaDB (NAS production)
|
|
by switching DB_TYPE — business code never branches on the backend.
|
|
"""
|
|
import os
|
|
|
|
from dotenv import load_dotenv
|
|
|
|
# Load .env from the backend directory (falls back to cwd / parent search).
|
|
_BACKEND_DIR = os.path.dirname(os.path.abspath(__file__))
|
|
_ENV_PATH = os.path.join(_BACKEND_DIR, ".env")
|
|
if os.path.exists(_ENV_PATH):
|
|
load_dotenv(_ENV_PATH)
|
|
else:
|
|
load_dotenv() # walk up from cwd
|
|
|
|
# --- Database selection -----------------------------------------------------
|
|
DB_TYPE = (os.environ.get("DB_TYPE") or "sqlite").lower()
|
|
|
|
# SQLite (default, zero-config local development)
|
|
SQLITE_PATH = os.environ.get("DATABASE_PATH") or os.path.join(
|
|
_BACKEND_DIR, "data", "health.db"
|
|
)
|
|
|
|
# MariaDB (production, runs on the NAS)
|
|
MARIADB_SOCKET = os.environ.get("MARIADB_SOCKET") or ""
|
|
MARIADB_HOST = os.environ.get("MARIADB_HOST") or "127.0.0.1"
|
|
MARIADB_PORT = int(os.environ.get("MARIADB_PORT") or 3306)
|
|
MARIADB_USER = os.environ.get("MARIADB_USER") or "root"
|
|
MARIADB_PASSWORD = os.environ.get("MARIADB_PASSWORD") or ""
|
|
MARIADB_DATABASE = os.environ.get("MARIADB_DATABASE") or "garmin_health_lab"
|
|
|
|
# --- Auth -------------------------------------------------------------------
|
|
JWT_SECRET = os.environ.get("JWT_SECRET") or "dev_secret_change_me"
|
|
JWT_EXPIRY_DAYS = int(os.environ.get("JWT_EXPIRY_DAYS") or 7)
|
|
|
|
# auth-hub OIDC/OAuth2 provider configuration. The client secret has no
|
|
# fallback on purpose — unlike the issuer URL and client id, it must never be
|
|
# hardcoded in source; put it in backend/.env (gitignored) instead.
|
|
AUTH_HUB_BASE_URL = os.environ.get("AUTH_HUB_BASE_URL") or "http://129.146.26.249:5300"
|
|
# Dev fallback client id (auth-hub keeps dev and prod clients in separate
|
|
# databases). Production always overrides this via backend/.env — the value
|
|
# in use is the client registered for https://garmin.zichuan.xyz/auth/callback.
|
|
AUTH_HUB_CLIENT_ID = os.environ.get("AUTH_HUB_CLIENT_ID") or "0asGO0FdX_XYOk6O"
|
|
AUTH_HUB_CLIENT_SECRET = os.environ.get("AUTH_HUB_CLIENT_SECRET") or ""
|
|
# Production sets this via backend/.env to https://garmin.zichuan.xyz/auth/callback
|
|
# — the fallback below is a dev-only placeholder, not a live production route.
|
|
AUTH_HUB_REDIRECT_URI = os.environ.get("AUTH_HUB_REDIRECT_URI") or "http://127.0.0.1:5500/auth/callback"
|
|
|
|
# --- Static UI --------------------------------------------------------------
|
|
# Directory holding the built React app. When set and populated, the Flask
|
|
# process serves the UI too, so a deployment is one port and one service.
|
|
STATIC_DIR = os.environ.get("STATIC_DIR") or os.path.join(_BACKEND_DIR, "static")
|
|
|
|
# --- Server -----------------------------------------------------------------
|
|
# BACKEND_PORT wins over PORT: `PORT` is set by many dev tools and PaaS
|
|
# runtimes for the *frontend*, and letting it through made Flask seize the
|
|
# React dev server's port during `npm run dev`.
|
|
PORT = int(os.environ.get("BACKEND_PORT") or os.environ.get("PORT") or 5000)
|
|
|
|
# Comma-separated list of allowed front-end origins (CORS).
|
|
_CORS_RAW = os.environ.get("CORS_ORIGIN") or "http://localhost:3000,http://localhost:5173"
|
|
CORS_ORIGINS = [o.strip() for o in _CORS_RAW.split(",") if o.strip()]
|