Establish secure account and managed AI backend

Provide the production foundation for Apple identity, immutable credits, referrals, integrity checks, managed providers, and hardened Docker deployment.
2026-08-16 14:46:23 +08:00
commit 0af35d44f4
124 changed files with 21052 additions and 0 deletions
@@ -0,0 +1,61 @@
+ktor:
+  application:
+    modules:
+      - com.osglab.account.ApplicationKt.module
+  deployment:
+    host: 0.0.0.0
+    port: "$PORT:8080"
+
+app:
+  environment: "$APP_ENV:development"
+  publicBaseUrl: "$PUBLIC_BASE_URL:https://account.osglab.com"
+  inviteBaseUrl: "$INVITE_BASE_URL:https://osglab.com/i"
+  appStoreUrl: "$APP_STORE_URL:https://apps.apple.com/app/id0000000000"
+  database:
+    jdbcUrl: "$DATABASE_URL:jdbc:mysql://localhost:3306/osg_account?useUnicode=true&characterEncoding=utf8&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true"
+    username: "$DATABASE_USER:osg_account"
+    password: "$DATABASE_PASSWORD"
+    migrationUsername: "$DATABASE_MIGRATION_USER:"
+    migrationPassword: "$DATABASE_MIGRATION_PASSWORD:"
+    maximumPoolSize: "$DATABASE_POOL_SIZE:10"
+  session:
+    issuer: "$JWT_ISSUER:https://account.osglab.com"
+    audience: "$JWT_AUDIENCE:osgkeyboard-ios"
+    secret: "$JWT_SECRET"
+    accessMinutes: "$ACCESS_TOKEN_MINUTES:15"
+    refreshDays: "$REFRESH_TOKEN_DAYS:30"
+    gatewayGrantDays: "$GATEWAY_GRANT_DAYS:30"
+  encryption:
+    keyBase64: "$FIELD_ENCRYPTION_KEY"
+  antiAbuse:
+    identityHmacKeyBase64: "$IDENTITY_HMAC_KEY"
+    tombstoneRetentionDays: "$IDENTITY_TOMBSTONE_RETENTION_DAYS:365"
+  apple:
+    teamId: "$APPLE_TEAM_ID:"
+    keyId: "$APPLE_KEY_ID:"
+    clientId: "$APPLE_CLIENT_ID:com.osgkeyboard.ios"
+    privateKeyPem: "$APPLE_PRIVATE_KEY_PEM:"
+    jwksUrl: "$APPLE_JWKS_URL:https://appleid.apple.com/auth/keys"
+    tokenUrl: "$APPLE_TOKEN_URL:https://appleid.apple.com/auth/token"
+    revokeUrl: "$APPLE_REVOKE_URL:https://appleid.apple.com/auth/revoke"
+  credits:
+    signupTrial: "$SIGNUP_TRIAL_CREDITS:1000"
+    referralInviter: "$REFERRAL_INVITER_CREDITS:3000"
+    referralInvitee: "$REFERRAL_INVITEE_CREDITS:3000"
+    referralBindingDays: "$REFERRAL_BINDING_DAYS:7"
+  providers:
+    volcengine:
+      endpoint: "$VOLCENGINE_ASR_ENDPOINT:wss://openspeech.bytedance.com/api/v3/sauc/bigmodel_async"
+      appId: "$VOLCENGINE_APP_ID:"
+      accessToken: "$VOLCENGINE_ACCESS_TOKEN:"
+      apiKey: "$VOLCENGINE_API_KEY:"
+      resourceId: "$VOLCENGINE_RESOURCE_ID:volc.seedasr.sauc.duration"
+    deepseek:
+      endpoint: "$DEEPSEEK_ENDPOINT:https://api.deepseek.com/v1"
+      apiKey: "$DEEPSEEK_API_KEY:"
+      model: "$DEEPSEEK_MODEL:deepseek-v4-flash"
+  integrity:
+    enforceDeviceCheck: "$ENFORCE_DEVICE_CHECK:false"
+    enforceAppAttest: "$ENFORCE_APP_ATTEST:false"
+    appleEnvironment: "$APPLE_INTEGRITY_ENVIRONMENT:development"
+    challengeLifetimeSeconds: "$APP_ATTEST_CHALLENGE_TTL_SECONDS:300"