发布 0.1.0:通知渠道、告警规则、令牌版本与安全加固

cmd/server/main.go

@@ -9,12 +9,15 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"os/signal"
+	"syscall"
 	"time"
 
 	// 纯 Go 时区数据(+~450KB):distroless/scratch 容器无 tzdata,
 	// 嵌入后 TZ 环境变量即可让 cron 按本地时区解释
 	_ "time/tzdata"
 
+	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
 
 	// swag 生成的 OpenAPI spec(init 时注册,SWAGGER=1 的 /swagger 路由消费)
@@ -35,6 +38,12 @@ import (
 // @in header
 // @name Authorization
 // @description 登录接口返回的 JWT,格式: Bearer <token>
+func init() {
+	if os.Getenv("GIN_MODE") == "" {
+		gin.SetMode(gin.ReleaseMode)
+	}
+}
+
 func main() {
 	healthcheck := flag.Bool("healthcheck", false, "探活本机服务后退出:健康 0,异常 1(容器 HEALTHCHECK 用)")
 	flag.Parse()
@@ -126,6 +135,7 @@ func run() error {
 	defer aiGateway.Wait()
 	defer stopCleanup()
 	tasks := service.NewTaskService(db, ociConfigs, notifier, settings)
+	ociConfigs.SetTenantCleanupDeps(tasks, logEvents)
 	tasks.AttachAiGateway(aiGateway)
 	aiGateway.SetOnChannelsChanged(tasks.SyncAiProbeTask)
 	if err := tasks.Start(); err != nil {
@@ -137,5 +147,34 @@ func run() error {
 	console := service.NewConsoleService(ociConfigs)
 	proxies := service.NewProxyService(db, cipher)
 	defer proxies.Wait()
-	return api.NewRouter(auth, oauth, ociConfigs, tasks, console, settings, notifier, systemLogs, logEvents, proxies, aiGateway).Run(cfg.Addr)
+	router := api.NewRouter(auth, oauth, ociConfigs, tasks, console, settings, notifier, systemLogs, logEvents, proxies, aiGateway)
+	return serveHTTP(cfg.Addr, router)
+}
+
+// serveHTTP 以显式超时与请求头上限启动 HTTP 服务,并在 SIGINT/SIGTERM 时
+// 优雅关闭(10 秒排空);防慢连接(Slowloris)与超大头耗尽资源。
+// WriteTimeout 置 0:AI 网关流式响应无固定上界,WebSocket 为 hijack 连接
+// 本就不受 net/http 超时管控;读侧超时已覆盖慢请求风险。
+func serveHTTP(addr string, handler http.Handler) error {
+	srv := &http.Server{
+		Addr:              addr,
+		Handler:           handler,
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       60 * time.Second,
+		IdleTimeout:       2 * time.Minute,
+		MaxHeaderBytes:    64 << 10,
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	errCh := make(chan error, 1)
+	go func() { errCh <- srv.ListenAndServe() }()
+	select {
+	case err := <-errCh:
+		return err
+	case <-ctx.Done():
+		log.Println("[info] shutting down http server")
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		return srv.Shutdown(shutdownCtx)
+	}
 }