v6ole
fcfa5af614
- feat(deploy): 前端多阶段构建 (vite build + nginx:alpine)，移除 Vite 开发模式 - feat(deploy): OpenResty HTTPS 配置 (SSL + HSTS + 安全头) - fix(ws): WebSocket 路由添加 /api 前缀，修正前后端路径不匹配 - security: SSH AutoAddPolicy → WarningPolicy - security: CORS 来源环境变量化 (CORS_ORIGINS) - security: 限流器使用 X-Forwarded-For 真实客户端 IP - perf(db): 数据库连接池配置 (pool_size=20, max_overflow=40) - refactor: 移除硬编码 URL/IP (NTP、域名、微信代理)，改为环境变量 - chore: 更新 .env.example 模板，补充新增配置项 - chore: 清理 .reasonix/、scripts/、guide.md 无用文件 - docs: 更新 CLAUDE.md 至 v0.10.0，补充生产架构文档 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
105 lines
3.6 KiB
Python
105 lines
3.6 KiB
Python
"""FastAPI 主应用"""
|
|
import os
|
|
import logging
|
|
from pythonjsonlogger import jsonlogger
|
|
from fastapi import FastAPI, Request
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from slowapi import Limiter, _rate_limit_exceeded_handler
|
|
from slowapi.errors import RateLimitExceeded
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.responses import JSONResponse
|
|
from app.core.config import settings
|
|
from app.api.v1 import auth, devices, check, import_data, stats, olt, provision, users, roles, inventory, settings as settings_api, audit, wechat, ws, monitor
|
|
from app.middleware.audit_middleware import AuditMiddleware
|
|
|
|
# 结构化 JSON 日志
|
|
_handler = logging.StreamHandler()
|
|
_handler.setFormatter(jsonlogger.JsonFormatter('%(asctime)s %(name)s %(levelname)s %(message)s'))
|
|
logging.getLogger().handlers = [_handler]
|
|
logging.getLogger().setLevel(logging.INFO)
|
|
logging.getLogger('uvicorn.access').handlers = [_handler]
|
|
|
|
# 请求体大小限制中间件
|
|
MAX_BODY_SIZE = 10 * 1024 * 1024 # 10 MB
|
|
|
|
class RequestSizeLimitMiddleware(BaseHTTPMiddleware):
|
|
async def dispatch(self, request: Request, call_next):
|
|
if request.headers.get("content-length"):
|
|
if int(request.headers["content-length"]) > MAX_BODY_SIZE:
|
|
return JSONResponse({"detail": "请求体过大，最大 10MB"}, status_code=413)
|
|
return await call_next(request)
|
|
|
|
# CORS 白名单 — 支持通过环境变量 CORS_ORIGINS 覆盖（逗号分隔）
|
|
CORS_ORIGINS_DEFAULT = "http://localhost:5173,http://localhost:18002,https://onu.dhdx.fun"
|
|
ALLOWED_ORIGINS = [o.strip() for o in os.getenv("CORS_ORIGINS", CORS_ORIGINS_DEFAULT).split(",") if o.strip()]
|
|
|
|
|
|
def get_client_ip(request: Request) -> str:
|
|
"""读取 X-Forwarded-For 首字段作为真实客户端 IP"""
|
|
forwarded = request.headers.get("X-Forwarded-For")
|
|
if forwarded:
|
|
return forwarded.split(",")[0].strip()
|
|
return request.client.host if request.client else "unknown"
|
|
|
|
|
|
limiter = Limiter(key_func=get_client_ip, default_limits=["120/minute"])
|
|
|
|
app = FastAPI(title=settings.APP_NAME, debug=settings.DEBUG)
|
|
app.state.limiter = limiter
|
|
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
|
|
|
|
app.add_middleware(RequestSizeLimitMiddleware)
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=ALLOWED_ORIGINS if ALLOWED_ORIGINS else ["*"],
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
app.add_middleware(AuditMiddleware)
|
|
|
|
app.include_router(auth.router)
|
|
app.include_router(devices.router)
|
|
app.include_router(check.router)
|
|
app.include_router(import_data.router)
|
|
app.include_router(stats.router)
|
|
app.include_router(olt.router)
|
|
app.include_router(provision.router)
|
|
app.include_router(users.router)
|
|
app.include_router(roles.router)
|
|
app.include_router(inventory.router)
|
|
app.include_router(settings_api.router)
|
|
app.include_router(audit.router)
|
|
app.include_router(wechat.router)
|
|
app.include_router(ws.router)
|
|
app.include_router(monitor.router)
|
|
|
|
|
|
@app.on_event("startup")
|
|
async def startup():
|
|
import asyncio
|
|
asyncio.create_task(ws._redis_listener())
|
|
|
|
|
|
@app.get("/health")
|
|
def health_check():
|
|
status = {"status": "ok", "db": "ok", "redis": "ok"}
|
|
try:
|
|
import redis
|
|
import psycopg2
|
|
r = redis.from_url(settings.REDIS_URL, socket_timeout=2)
|
|
r.ping()
|
|
except Exception:
|
|
status["redis"] = "error"
|
|
status["status"] = "degraded"
|
|
try:
|
|
from sqlalchemy import text
|
|
from app.core.database import SessionLocal
|
|
db = SessionLocal()
|
|
db.execute(text("SELECT 1"))
|
|
db.close()
|
|
except Exception:
|
|
status["db"] = "error"
|
|
status["status"] = "degraded"
|
|
return status
|