feat: harden data access and simplify user management

docker-compose.yml

@@ -30,6 +30,8 @@ services:
       MYSQL_DATABASE: ${MYSQL_DATABASE:-platform_control}
       MYSQL_USER: ${MYSQL_USER:-data_center}
       MYSQL_PASSWORD: ${MYSQL_PASSWORD:-change-this-data-password}
+      MYSQL_ACCESS_BROKER_USER: ${MYSQL_ACCESS_BROKER_USER:-access_broker}
+      MYSQL_ACCESS_BROKER_PASSWORD: ${MYSQL_ACCESS_BROKER_PASSWORD:-change-this-access-broker-credential}
     command:
       - --character-set-server=utf8mb4
       - --collation-server=utf8mb4_0900_ai_ci
@@ -90,6 +92,26 @@ services:
       timeout: 5s
       retries: 10
 
+  dbeaver-gateway:
+    build:
+      context: ./deploy/dbeaver-gateway
+    image: travel-knowledge-graph-dbeaver-gateway:local
+    container_name: travel-kg-dbeaver-gateway
+    restart: unless-stopped
+    ports:
+      - "${DATA_MYSQL_SSH_BIND:-127.0.0.1}:${DATA_MYSQL_SSH_PORT:-2222}:22"
+    volumes:
+      - dbeaver-access:/var/lib/travel-kg/dbeaver-access
+      - dbeaver-ssh-host-keys:/etc/ssh/host-keys
+    depends_on:
+      mysql:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "nc -z 127.0.0.1 22 && nc -z 127.0.0.1 3307"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
   api:
     build:
       context: .
@@ -108,14 +130,20 @@ services:
       DATA_MYSQL_POOL_MAX_SIZE: ${DATA_MYSQL_POOL_MAX_SIZE:-20}
       DATA_SQL_CONSOLE_WRITE_ENABLED: ${DATA_SQL_CONSOLE_WRITE_ENABLED:-false}
       INTERFACE_API_SECRET: ${INTERFACE_API_SECRET:-change-me-interface-api-secret}
-      DATA_MYSQL_DIRECT_ACCESS_ENABLED: ${DATA_MYSQL_DIRECT_ACCESS_ENABLED:-false}
+      DATA_MYSQL_DIRECT_ACCESS_ENABLED: ${DATA_MYSQL_DIRECT_ACCESS_ENABLED:-true}
       DATA_MYSQL_PUBLIC_HOST: ${DATA_MYSQL_PUBLIC_HOST:-}
       DATA_MYSQL_PUBLIC_PORT: ${DATA_MYSQL_PUBLIC_PORT:-0}
       DATA_MYSQL_DIRECT_TRANSPORT: ${DATA_MYSQL_DIRECT_TRANSPORT:-SSH 隧道（强制）}
       DATA_MYSQL_SSH_TUNNEL_REQUIRED: ${DATA_MYSQL_SSH_TUNNEL_REQUIRED:-true}
       DATA_MYSQL_SSH_HOST: ${DATA_MYSQL_SSH_HOST:-}
-      DATA_MYSQL_SSH_PORT: ${DATA_MYSQL_SSH_PORT:-22}
+      DATA_MYSQL_SSH_PORT: ${DATA_MYSQL_SSH_PORT:-2222}
+      DATA_MYSQL_SSH_USERNAME: ${DATA_MYSQL_SSH_USERNAME:-dbeaver}
       DATA_MYSQL_SSH_AUTH_METHOD: ${DATA_MYSQL_SSH_AUTH_METHOD:-SSH 私钥 / SSH Agent}
+      DATA_MYSQL_MANAGED_ACCESS_ENABLED: ${DATA_MYSQL_MANAGED_ACCESS_ENABLED:-true}
+      DATA_MYSQL_SSH_AUTHORIZED_KEYS_FILE: ${DATA_MYSQL_SSH_AUTHORIZED_KEYS_FILE:-/var/lib/travel-kg/dbeaver-access/authorized_keys}
+      DATA_MYSQL_SSH_HOST_PUBLIC_KEY_FILE: ${DATA_MYSQL_SSH_HOST_PUBLIC_KEY_FILE:-/var/lib/travel-kg/dbeaver-access/ssh_host_ed25519_key.pub}
+      DATA_MYSQL_PROVISIONER_USER: ${MYSQL_ACCESS_BROKER_USER:-access_broker}
+      DATA_MYSQL_PROVISIONER_PASSWORD: ${MYSQL_ACCESS_BROKER_PASSWORD:-change-this-access-broker-credential}
       DATA_MYSQL_ADMIN_HOST: ${DATA_MYSQL_ADMIN_HOST:-127.0.0.1}
       DATA_MYSQL_ADMIN_PORT: ${DATA_MYSQL_ADMIN_PORT:-${MYSQL_PORT:-3307}}
       DATA_MYSQL_ADMIN_ACCOUNT_POLICY: ${DATA_MYSQL_ADMIN_ACCOUNT_POLICY:-一人一号 · 单库授权 · 禁止 root}
@@ -161,6 +189,8 @@ services:
       GAODE_CRAWLER_PATH: ${GAODE_CRAWLER_PATH:-}
     ports:
       - "${API_HOST_BIND:-0.0.0.0}:${API_PORT:-8102}:8000"
+    volumes:
+      - dbeaver-access:/var/lib/travel-kg/dbeaver-access
     depends_on:
       postgres:
         condition: service_healthy
@@ -168,6 +198,8 @@ services:
         condition: service_healthy
       falkordb:
         condition: service_healthy
+      dbeaver-gateway:
+        condition: service_healthy
     healthcheck:
       test:
         [
@@ -185,3 +217,5 @@ volumes:
   postgres-data:
   mysql-data:
   falkordb-data:
+  dbeaver-access:
+  dbeaver-ssh-host-keys: