feat: streamline platform and secure data access

- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces

docker-compose.yml

@@ -21,6 +21,41 @@ services:
       timeout: 5s
       retries: 10
 
+  mysql:
+    image: mysql:8.4
+    container_name: travel-kg-mysql
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-change-this-root-password}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-platform_control}
+      MYSQL_USER: ${MYSQL_USER:-data_center}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-change-this-data-password}
+    command:
+      - --character-set-server=utf8mb4
+      - --collation-server=utf8mb4_0900_ai_ci
+      - --default-time-zone=+00:00
+      - --partial-revokes=ON
+      - --local-infile=OFF
+      - --secure-file-priv=NULL
+      - --skip-name-resolve=ON
+      - --skip-symbolic-links
+      - --server-id=1
+      - --log-bin=mysql-bin
+      - --binlog-format=ROW
+      - --binlog-expire-logs-seconds=604800
+      - --sync-binlog=1
+      - --innodb-flush-log-at-trx-commit=1
+    ports:
+      - "${MYSQL_HOST_BIND:-127.0.0.1}:${MYSQL_PORT:-3307}:3306"
+    volumes:
+      - mysql-data:/var/lib/mysql
+      - ./docker/mysql-init/01-data-center-grants.sh:/docker-entrypoint-initdb.d/01-data-center-grants.sh:ro
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -p\"$${MYSQL_ROOT_PASSWORD}\" --silent"]
+      interval: 10s
+      timeout: 5s
+      retries: 15
+
   falkordb-seed:
     image: busybox:1.36
     restart: "no"
@@ -67,15 +102,50 @@ services:
       DATABASE_URL: postgresql://${POSTGRES_USER:-admin}:${POSTGRES_PASSWORD:-password}@postgres:5432/${POSTGRES_DB:-kg_admin}
       DB_SCHEMA: ${DB_SCHEMA:-kg_admin_new2}
       DB_MIGRATIONS_ENABLED: ${DOCKER_DB_MIGRATIONS_ENABLED:-false}
+      DATA_MYSQL_URL: mysql://${MYSQL_USER:-data_center}:${MYSQL_PASSWORD:-change-this-data-password}@mysql:3306/${MYSQL_DATABASE:-platform_control}
+      DATA_MYSQL_REQUIRED: "true"
+      DATA_MYSQL_POOL_MIN_SIZE: ${DATA_MYSQL_POOL_MIN_SIZE:-2}
+      DATA_MYSQL_POOL_MAX_SIZE: ${DATA_MYSQL_POOL_MAX_SIZE:-20}
+      DATA_SQL_CONSOLE_WRITE_ENABLED: ${DATA_SQL_CONSOLE_WRITE_ENABLED:-false}
+      INTERFACE_API_SECRET: ${INTERFACE_API_SECRET:-change-me-interface-api-secret}
+      DATA_MYSQL_DIRECT_ACCESS_ENABLED: ${DATA_MYSQL_DIRECT_ACCESS_ENABLED:-false}
+      DATA_MYSQL_PUBLIC_HOST: ${DATA_MYSQL_PUBLIC_HOST:-}
+      DATA_MYSQL_PUBLIC_PORT: ${DATA_MYSQL_PUBLIC_PORT:-0}
+      DATA_MYSQL_DIRECT_TRANSPORT: ${DATA_MYSQL_DIRECT_TRANSPORT:-SSH 隧道（强制）}
+      DATA_MYSQL_SSH_TUNNEL_REQUIRED: ${DATA_MYSQL_SSH_TUNNEL_REQUIRED:-true}
+      DATA_MYSQL_SSH_HOST: ${DATA_MYSQL_SSH_HOST:-}
+      DATA_MYSQL_SSH_PORT: ${DATA_MYSQL_SSH_PORT:-22}
+      DATA_MYSQL_SSH_AUTH_METHOD: ${DATA_MYSQL_SSH_AUTH_METHOD:-SSH 私钥 / SSH Agent}
+      DATA_MYSQL_ADMIN_HOST: ${DATA_MYSQL_ADMIN_HOST:-127.0.0.1}
+      DATA_MYSQL_ADMIN_PORT: ${DATA_MYSQL_ADMIN_PORT:-${MYSQL_PORT:-3307}}
+      DATA_MYSQL_ADMIN_ACCOUNT_POLICY: ${DATA_MYSQL_ADMIN_ACCOUNT_POLICY:-一人一号 · 单库授权 · 禁止 root}
+      DATA_MYSQL_AUDIT_ENABLED: ${DATA_MYSQL_AUDIT_ENABLED:-false}
+      MYSQL_HOST_BIND: ${MYSQL_HOST_BIND:-127.0.0.1}
+      DATA_BACKUP_ENABLED: ${DATA_BACKUP_ENABLED:-false}
+      DATA_BACKUP_ENCRYPTION_REQUIRED: ${DATA_BACKUP_ENCRYPTION_REQUIRED:-true}
+      DATA_BACKUP_RETENTION_DAYS: ${DATA_BACKUP_RETENTION_DAYS:-30}
       FALKORDB_HOST: falkordb
       FALKORDB_PORT: "6379"
       FALKORDB_GRAPH: ${FALKORDB_GRAPH:-guiyang_new2}
       FALKORDB_PASSWORD: ${FALKORDB_PASSWORD:-}
       AUTH_SECRET: ${AUTH_SECRET:-change-me-32-chars-minimum-secret}
       AUTH_ALGORITHM: ${AUTH_ALGORITHM:-HS256}
-      AUTH_TOKEN_EXPIRE_MINUTES: ${AUTH_TOKEN_EXPIRE_MINUTES:-480}
+      AUTH_ISSUER: ${AUTH_ISSUER:-zn-kg-admin}
+      AUTH_AUDIENCE: ${AUTH_AUDIENCE:-zn-kg-admin-web}
+      AUTH_TOKEN_EXPIRE_MINUTES: ${AUTH_TOKEN_EXPIRE_MINUTES:-60}
       AUTH_DEFAULT_USERNAME: ${AUTH_DEFAULT_USERNAME:-admin@example.com}
       AUTH_DEFAULT_PASSWORD: ${AUTH_DEFAULT_PASSWORD:-change-me}
+      AUTH_LOGIN_MAX_ATTEMPTS: ${AUTH_LOGIN_MAX_ATTEMPTS:-5}
+      AUTH_LOGIN_WINDOW_SECONDS: ${AUTH_LOGIN_WINDOW_SECONDS:-300}
+      AUTH_LOGIN_LOCK_SECONDS: ${AUTH_LOGIN_LOCK_SECONDS:-900}
+      INTERFACE_API_DEFAULT_EXPIRY_DAYS: ${INTERFACE_API_DEFAULT_EXPIRY_DAYS:-30}
+      INTERFACE_API_MAX_EXPIRY_DAYS: ${INTERFACE_API_MAX_EXPIRY_DAYS:-90}
+      INTERFACE_API_RATE_LIMIT_PER_MINUTE: ${INTERFACE_API_RATE_LIMIT_PER_MINUTE:-120}
+      APP_ENVIRONMENT: ${APP_ENVIRONMENT:-development}
+      SECURITY_STRICT_MODE: ${SECURITY_STRICT_MODE:-false}
+      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:8102,http://127.0.0.1:8102}
+      TRUSTED_HOSTS: ${TRUSTED_HOSTS:-*}
+      SECURITY_HEADERS_ENABLED: ${SECURITY_HEADERS_ENABLED:-true}
       DEFAULT_TENANT: ${DEFAULT_TENANT:-CityGraph-new2}
       DEFAULT_PROJECT: ${DEFAULT_PROJECT:-CityGraph-new2}
       INGEST_API_KEYS: ${INGEST_API_KEYS:-dev-key-1}
@@ -94,6 +164,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      mysql:
+        condition: service_healthy
       falkordb:
         condition: service_healthy
     healthcheck:
@@ -111,4 +183,5 @@ services:
 
 volumes:
   postgres-data:
+  mysql-data:
   falkordb-data: