mirror of https://github.com/fastapiadmin/FastapiAdmin.git synced 2026-10-14 13:06:51 +00:00

T

zhangtao 1e9e12489d security(deploy): 生产凭据轮换 + 镜像不再携带口令

轮换（MySQL 应用用户 / MySQL root / Redis，实测旧值被拒）
- 旧 MySQL app 口令 → ERROR 1045 (28000) Access denied；旧 root 同被拒
- 旧 Redis 口令 → AUTH failed: WRONGPASS
- 新口令：容器内直连成功；应用健康 db_status=1 / redis_status=1；四端 200；容器全 healthy
- .env 保持 600，轮换前备份 .env.bak-rotate-*

镜像卫生（审计 B3 根治）
- deploy-artifacts.sh 构建时剔除 DATABASE_PASSWORD / REDIS_PASSWORD /
  SECRET_KEY / DATA_ENCRYPTION_KEY / DATA_ENCRYPTION_OLD_KEYS / MYSQL_* 口令键，
  仅保留主机、端口等非敏感项；口令全部由 compose 运行时注入
- 重建后镜像内 /home/env/.env.prod 口令类键命中 0 条；容器 env 仍持有 4 个密钥且应用正常
- 本地 backend/env/.env.prod 中泄露值清空并 chmod 600

文档
- DEPLOYMENT.md 新增「凭据轮换」标准步骤（含 mysql/redis 健康检查需一并重建、
  docker exec -i 会吞脚本 stdin 的排查提示）
- AUDIT-REPORT.md 记录公开仓库历史暴露面与待用户侧吊销项（OpenAI Key）

说明：仓库为 public，历史中真实出现过 OpenAI Key 与旧口令；旧口令本轮已失效，
OpenAI Key 需到控制台吊销（第三方无法代办）。是否用 git-filter-repo 清洗历史见报告 §10。

2026-10-04 06:39:30 +08:00

.github/workflows

ci(frontend): 类型检查前先执行生产构建以生成自动导入声明

2026-10-04 06:16:59 +08:00

backend

chore(backend): 新增 basedpyright 校准配置，并修复它暴露的三处真缺陷

2026-10-04 06:00:16 +08:00

docker

chore(deploy): 健康检查发正确 Host、list 型配置改 JSON、Host 校验收窄

2026-10-04 05:12:37 +08:00

frontend

fix(web): 错误提示改为后端 msg 优先，去掉业务码白名单耦合

2026-10-04 05:44:26 +08:00

.dockerignore

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

.gitignore

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

AUDIT-REPORT.md

security(deploy): 生产凭据轮换 + 镜像不再携带口令

2026-10-04 06:39:30 +08:00

CHANGELOG.md

docs: 更新贡献指南，补充小程序开发说明

2026-09-06 21:19:58 +08:00

CONTRIBUTING.md

docs: 更新贡献指南，补充小程序开发说明

2026-09-06 21:19:58 +08:00

deploy-artifacts.sh

security(deploy): 生产凭据轮换 + 镜像不再携带口令

2026-10-04 06:39:30 +08:00

deploy.sh

chore(docker): 调整 dockerignore 排除上传目录

2026-09-07 01:38:38 +08:00

DEPLOYMENT.md

security(deploy): 生产凭据轮换 + 镜像不再携带口令

2026-10-04 06:39:30 +08:00

LICENSE

chore: 更新项目所有者信息为fastapiadmin

2026-01-18 03:35:38 +08:00

README.en.md

docs(readme): 更新项目说明与界面截图

2026-09-06 20:52:11 +08:00

README.md

docs(readme): 更新项目说明与界面截图

2026-09-06 20:52:11 +08:00

REQUIREMENTS.md

docs: add SaaS multi-tenant platform requirements

2026-09-06 21:19:50 +08:00

SKILL.md

refactor(router): simplify route cache logic, remove nested parent component

2026-09-14 01:06:20 +08:00

README.en.md

FastApiAdmin ^v3.0.0

🚀 Exceptional Code Quality, Production-Ready Admin Dashboard in 5 Minutes

Full-stack rapid development platform powered by FastAPI + Vue3 + TypeScript. Web, H5, and Mini Program — all in one project.

English | 简体中文

🖥️ Screenshots

Web

Mobile (H5 / Mini Program / App from one codebase)

💡 Why FastapiAdmin?

You Need	FastapiAdmin	Django Admin	Frontend-Only
🎯 Ready-to-use admin system	✅	⚠️ Limited	❌ UI only
⚡ FastAPI async high-performance backend	✅	❌ Sync-first	❌ No backend
🔐 RBAC menu/button/data level permissions	✅	❌ Basic	❌
🤖 Code generator (table → full CRUD)	✅	❌	❌
📱 Mobile (H5 + Mini Program) included	✅	❌	❌
🐳 Docker one-click deploy (Nginx + SSL)	✅	❌	❌

👉 Full comparison: Why FastapiAdmin?

🍪 Live Demo

	URL	Account
💻 Web	service.fastapiadmin.com/web	`admin` / `123456`
📱 Mobile	service.fastapiadmin.com/app	`admin` / `123456`
📖 Official Docs	service.fastapiadmin.com	No login

🚀 5-Minute Quick Start

# 1. Clone
git clone https://github.com/fastapiadmin/FastapiAdmin.git

# 2. Configure environments
cp backend/env/.env.example backend/env/.env.dev
cp frontend/web/.env.development.example frontend/web/.env.development

# 3. Start backend (auto-creates tables + seed data on first run)
cd backend && uv sync && uv run main.py run --env=dev

# 4. Start frontend
cd ../frontend/web && pnpm install && pnpm run dev

# ✅ Open http://127.0.0.1:5173, login with admin/123456

Requirements
Python ≥ 3.12	Node.js ≥ 20 + pnpm
MySQL 8.0+ / PostgreSQL 14+	Redis 6.x / 7.x

🐳 Or: One-Command Docker Deployment

cp docker/.env.example docker/.env    # Fill in MySQL / Redis passwords
./deploy.sh                           # Build images and start the full stack (Nginx + SSL included)

For ports, SSL certificates and frontend builds, see the Docker deployment guide.

📦 Structure

FastapiAdmin/            # Monorepo full-stack project
├─ backend/              # FastAPI backend (Pydantic 2.0 + SQLAlchemy + Alembic)
├─ frontend/
│   ├── web/             # Vue3 Web (Element Plus + TypeScript)
│   ├── app/             # UniApp Mobile (H5 + Mini Program + App)
│   └── docs/            # VitePress documentation
├─ docker/               # Docker Compose deploy (Nginx + SSL)
├─ deploy.sh             # One-click deploy script
└─ LICENSE               # MIT

📌 Built-in Features

200+ REST endpoints · MySQL / PostgreSQL / SQLite · SFTP / S3 / OSS / COS / OBS storage adapters · Trim modules with a single ENABLED_MODULES entry

Core Modules (always enabled, cannot be removed)

Module	Capabilities
📊 Dashboard	Workbench, Analytics
⚙️ System Management	Users, Roles, Menus, Departments, Positions, Dicts, Config, Notices, Tickets, Versions
👀 Monitoring	Online users, Server monitoring, Cache monitoring
📝 Logs	Operation audit
🧰 Dev Tools	API Docs

Extension Modules (enabled by default, trim via `ENABLED_MODULES`)

Module	Capabilities	Toggle
🧩 Task Management	Scheduled tasks + visual workflow orchestration (built-in business nodes)	`task`
🔧 Code Generator	Table → full frontend/backend code	`generator`
📁 Storage	Unified file / object storage (SFTP / S3 / OSS / COS / OBS)	`storage`
🤖 AI Chat	Agno-powered agent conversations	`ai`
💬 Internal Chat	Text-only private / group chat between users (WebSocket real-time push + unread badge)	`chat`

🔧 Module Toggling

Extension modules can be enabled/disabled on demand via ENABLED_MODULES in backend/app/config/setting.py — just remove an item from the list; no code or menu deletion needed. The corresponding REST endpoints, WebSocket endpoints and initialization logic will not be loaded automatically:

# e.g. Disable internal chat and AI assistant, keep the rest
ENABLED_MODULES = ["generator", "task", "storage"]

🚦 Deployment Notes

Chat scope: Internal chat is positioned as lightweight internal communication — text-only messages. No file transfer, recall, read receipts, or multi-device sync (IM features). For strong IM needs, integrate mature products such as WeCom / DingTalk / Feishu. It can be disabled anytime by removing chat from ENABLED_MODULES.
Single-instance deployment: Real-time features (internal chat WebSocket, scheduled task scheduler) rely on in-memory connections and local scheduling within a single instance — please deploy as a single instance. For horizontal scaling, integrate Redis Pub/Sub or a message queue yourself.
Key security: Configure all third-party keys (AI, cloud storage, etc.) in the backend/env/.env.* environment variables. Never commit them to the repository or store them in the database.
Database migrations: Manage schema changes with Alembic migrations in production (uv run alembic upgrade head); create_all is only a fallback for first-time initialization.