root
b939cfa2fa
Multi-replica deployments need every Pod/container to share one RSA private key, otherwise public keys handed to the browser may not match the key that decrypts the resulting ciphertext. Introduce a `*.local.yaml` override layer that ops-config and tenant-config both load on top of the base config, ship example overrides plus compose/k3s wiring, and tolerate PEM bodies that arrive folded or escaped from Secrets.
12 lines
503 B
Plaintext
12 lines
503 B
Plaintext
auth:
|
||
password_cipher:
|
||
enabled: true
|
||
key_id: login-password-rsa-oaep-v1
|
||
# 多 Pod / 多容器部署必须使用同一把私钥。复制本文件为 config.local.yaml，
|
||
# 再粘贴完整 PEM；不要提交生产私钥。留空时应用会生成单进程临时私钥，
|
||
# 只适合本机单副本试跑，不适合多副本生产。
|
||
#
|
||
# 生成示例：
|
||
# openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out login-password-rsa.pem
|
||
private_key_pem: ""
|