fix(security): complete security and delivery compliance remediation

deploy/.env.example

@@ -13,10 +13,17 @@ DEBUG=false
 
 # 应用密钥 (使用 openssl rand -hex 32 生成)
 SECRET_KEY=your-secret-key-change-in-production
+# OLT SSH 密码加密密钥；请通过受控密钥服务或受限环境变量注入，切勿提交至仓库
+# 生成示例：python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+CREDENTIAL_ENCRYPTION_KEY=
 
 # 时区设置
 TZ=Asia/Shanghai
 
+# 宿主机发布端口。并行验证时可改为未占用端口，确认后再切换为正式端口。
+BACKEND_PORT=8001
+FRONTEND_PORT=18062
+
 # ============================================
 # 数据库配置 (PostgreSQL)
 # ============================================
@@ -67,6 +74,8 @@ CASDOOR_APP_NAME=h3c-onu-ms
 
 # Casdoor 回调地址（部署后改为实际域名）
 CASDOOR_REDIRECT_URL=
+# 为空时使用 CASDOOR_ENDPOINT；JWT 的 iss 必须与此值一致
+CASDOOR_ISSUER=
 
 # ============================================
 # SSH连接配置
@@ -127,7 +136,7 @@ IMC_API_URL=
 IMC_API_USERNAME=
 IMC_API_PASSWORD=
 # 本地认证不需要 SSL 验证
-IMC_API_VERIFY_SSL=false
+IMC_API_VERIFY_SSL=true
 IMC_CONNECT_TIMEOUT=5
 IMC_READ_TIMEOUT=20
 
@@ -206,4 +215,4 @@ BACKUP_SCHEDULE="0 2 * * *"
 # DEBUG=true
 # DATABASE_URL=postgresql://h3c_user:password@localhost:5432/h3c_onu_ms_dev
 # REDIS_URL=redis://localhost:6379/0
-# VITE_API_BASE_URL=http://localhost:8000
+# VITE_API_BASE_URL=http://localhost:8000

deploy/docker-compose.yml

@@ -6,7 +6,7 @@ services:
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-backend
     ports:
-      - "8001:8000"
+      - "${BACKEND_PORT:-8001}:8000"
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - REDIS_URL=${REDIS_URL}
@@ -17,7 +17,9 @@ services:
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
       - CASDOOR_REDIRECT_URL=${CASDOOR_REDIRECT_URL:-}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - DEBUG=${DEBUG:-false}
       - CORS_ORIGINS=${CORS_ORIGINS:-}
       - FRONTEND_URL=${FRONTEND_URL:-https://onu.dhdx.fun}
@@ -60,7 +62,9 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - WECHAT_CORPID=${WECHAT_CORPID:-}
       - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
       - WECHAT_AGENTID=${WECHAT_AGENTID:-}
@@ -90,7 +94,9 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_ISSUER=${CASDOOR_ISSUER:-}
       - SECRET_KEY=${SECRET_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
       - WECHAT_CORPID=${WECHAT_CORPID:-}
       - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
       - WECHAT_AGENTID=${WECHAT_AGENTID:-}
@@ -111,12 +117,12 @@ services:
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-frontend
     ports:
-      - "18062:80"
+      - "${FRONTEND_PORT:-18062}:80"
     depends_on:
       - backend
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/health"]
       interval: 30s
       timeout: 10s
       retries: 3