feat: harden data access and simplify user management

docker-compose.server.yml

@@ -1,4 +1,32 @@
 services:
+  mysql-storage-guard:
+    image: busybox:1.36
+    restart: "no"
+    user: "${MYSQL_CONTAINER_UID:-999}:${MYSQL_CONTAINER_GID:-999}"
+    environment:
+      MYSQL_STORAGE_ID: ${MYSQL_STORAGE_ID:?必须设置 MYSQL_STORAGE_ID}
+      MYSQL_STORAGE_MARKER: /storage-id
+      MYSQL_DATA_PATH: /data
+    command: ["sh", "/usr/local/bin/mysql-storage-guard.sh"]
+    volumes:
+      - type: bind
+        source: ${MYSQL_STORAGE_MOUNT:?必须设置 MYSQL_STORAGE_MOUNT}/.nianxx-mysql-storage-id
+        target: /storage-id
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${MYSQL_DATA_DIR:?必须设置 MYSQL_DATA_DIR}
+        target: /data
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ./docker/mysql-storage-guard.sh
+        target: /usr/local/bin/mysql-storage-guard.sh
+        read_only: true
+        bind:
+          create_host_path: false
+
   postgres:
     environment:
       POSTGRES_USER: ${POSTGRES_USER:?必须设置 POSTGRES_USER}
@@ -11,6 +39,29 @@ services:
       MYSQL_DATABASE: ${MYSQL_DATABASE:-platform_control}
       MYSQL_USER: ${MYSQL_USER:?必须设置 MYSQL_USER}
       MYSQL_PASSWORD: ${MYSQL_PASSWORD:?必须设置 MYSQL_PASSWORD}
+      MYSQL_ACCESS_BROKER_USER: ${MYSQL_ACCESS_BROKER_USER:-access_broker}
+      MYSQL_ACCESS_BROKER_PASSWORD: ${MYSQL_ACCESS_BROKER_PASSWORD:?必须设置 MYSQL_ACCESS_BROKER_PASSWORD}
+    ports: !override
+      - "127.0.0.1:${MYSQL_PORT:-3307}:3306"
+    volumes: !override
+      - type: bind
+        source: ${MYSQL_DATA_DIR:?必须设置 MYSQL_DATA_DIR}
+        target: /var/lib/mysql
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ./docker/mysql-init/01-data-center-grants.sh
+        target: /docker-entrypoint-initdb.d/01-data-center-grants.sh
+        read_only: true
+        bind:
+          create_host_path: false
+    depends_on:
+      mysql-storage-guard:
+        condition: service_completed_successfully
+
+  dbeaver-gateway:
+    ports: !override
+      - "${DATA_MYSQL_SSH_BIND:-127.0.0.1}:${DATA_MYSQL_SSH_PORT:-2222}:22"
 
   api:
     network_mode: host
@@ -27,7 +78,24 @@ services:
       CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:?必须设置后台 HTTPS 来源}
       TRUSTED_HOSTS: ${TRUSTED_HOSTS:?必须设置服务器域名}
       MYSQL_HOST_BIND: 127.0.0.1
+      DATA_MYSQL_STORAGE_BACKEND: dedicated-block
+      DATA_MYSQL_STORAGE_ID: ${MYSQL_STORAGE_ID:?必须设置 MYSQL_STORAGE_ID}
+      DATA_MYSQL_STORAGE_MOUNT: ${MYSQL_STORAGE_MOUNT:?必须设置 MYSQL_STORAGE_MOUNT}
+      DATA_MYSQL_DATA_DIR: ${MYSQL_DATA_DIR:?必须设置 MYSQL_DATA_DIR}
+      DATA_BACKUP_ENABLED: ${DATA_BACKUP_ENABLED:?生产环境必须设置 DATA_BACKUP_ENABLED=true}
+      DATA_BACKUP_ENCRYPTION_REQUIRED: "true"
+      DATA_BACKUP_RETENTION_DAYS: ${DATA_BACKUP_RETENTION_DAYS:-30}
+      DATA_BACKUP_ROOT: ${DATA_BACKUP_ROOT:?必须设置项目外 DATA_BACKUP_ROOT}
       DATA_MYSQL_SSH_TUNNEL_REQUIRED: "true"
+      DATA_MYSQL_DIRECT_ACCESS_ENABLED: "true"
+      DATA_MYSQL_MANAGED_ACCESS_ENABLED: "true"
+      DATA_MYSQL_SSH_HOST: ${DATA_MYSQL_SSH_HOST:-}
+      DATA_MYSQL_SSH_PORT: ${DATA_MYSQL_SSH_PORT:-2222}
+      DATA_MYSQL_SSH_USERNAME: ${DATA_MYSQL_SSH_USERNAME:-dbeaver}
+      DATA_MYSQL_SSH_AUTHORIZED_KEYS_FILE: /var/lib/travel-kg/dbeaver-access/authorized_keys
+      DATA_MYSQL_SSH_HOST_PUBLIC_KEY_FILE: /var/lib/travel-kg/dbeaver-access/ssh_host_ed25519_key.pub
+      DATA_MYSQL_PROVISIONER_USER: ${MYSQL_ACCESS_BROKER_USER:-access_broker}
+      DATA_MYSQL_PROVISIONER_PASSWORD: ${MYSQL_ACCESS_BROKER_PASSWORD:?必须设置 MYSQL_ACCESS_BROKER_PASSWORD}
       DATA_SQL_CONSOLE_WRITE_ENABLED: "false"
       FALKORDB_HOST: 127.0.0.1
       FALKORDB_PORT: ${FALKORDB_PORT:-6380}