chore: merge delta-force-guide-server into server/

git-subtree-dir: server
git-subtree-mainline: 2a3d7fdb25
git-subtree-split: 099f138206

server/config/application-prod.yaml.example

@@ -0,0 +1,131 @@
+spring:
+  datasource:
+    # PostgreSQL connection URL.
+    url: jdbc:postgresql://localhost:5432/dfguide_dev
+
+    # PostgreSQL username.
+    username: postgres
+
+    # PostgreSQL password.
+    password: 123456
+
+    # PostgreSQL JDBC driver class name.
+    driver-class-name: org.postgresql.Driver
+  data:
+    redis:
+      # Redis server host.
+      host: localhost
+
+      # Redis server port.
+      port: 6379
+
+      # Redis database index.
+      #
+      # Default to 0.
+      database: 0
+
+      # Redis server password.
+      #
+      # Uncomment if the server requires a password.
+      #
+      # password: qwerty
+
+logging:
+  pattern:
+    # Date format used in log output. Uncomment to use a custom format.
+    #
+    # Default to the date format provided by Spring Boot.
+    # dateformat: dd MMM yyyy HH:mm:ss.SSS
+
+app:
+  cookie:
+    # Whether the cookie is accessible from JavaScript. Keep `true` to mitigate XSS attacks.
+    http-only: true
+
+    # Whether the cookie is only sent over HTTPS. Set to `true` in production is recommended.
+    secure: true
+
+    # SameSite policy of the cookie.
+    #
+    # NOTE that `none` requires `secure` to be `true`.
+    same-site: none
+
+    # Cookie path.
+    path: '/'
+
+    # Cookie max age.
+    max-age: P1D
+  cors:
+    # Cross-origin allowed origins. Add your custom origins here.
+    allowed-origins: []
+
+    # Whether to allow credentials (cookies, authorisation headers) in cross-origin requests.
+    #
+    # Must be `true` since the application uses cookies for authentication. Change it only when
+    # the authentication mechanism no longer relies on cookies.
+    allow-credentials: true
+
+    # Whether to allow requests originating from private network addresses.
+    allow-private-network: false
+
+    # Headers allowed in cross-origin requests.
+    allowed-headers:
+      - "Content-Type"
+      - "Authorization"
+
+    # HTTP methods allowed in cross-origin requests.
+    #
+    # Methods are matched against Spring's HttpMethod, so they must be written in UPPER CASE.
+    # e.g., GET, POST, PUT, PATCH, DELETE, OPTIONS
+    allowed-methods:
+      - GET
+      - POST
+      - PUT
+      - PATCH
+      - DELETE
+
+    # Response headers exposed to the browser in cross-origin responses.
+    exposed-headers:
+      - "Content-Type"
+      - "Authorization"
+
+    # How long the CORS pre-flight response may be cached by the browser.
+    #
+    # Default to PT2H (2 hours).
+    max-age: PT2H
+  jwt:
+    # Issuer identifier, domain name is recommended.
+    issuer: dfguide.local
+
+    # Token signing secret, a 32-byte long or longer string is recommended.
+    secret: qwertyuiopasdfghjklzxcvbnm123456
+
+    # Token valid duration.
+    #
+    # Default to PT2H (2 hours).
+    valid-time: PT2H
+
+    # Token renew threshold.
+    #
+    # If valid time of this token is less than this value, then a new token will be delivered to
+    # the user.
+    #
+    # Default to PT5M (5 min).
+    renew-threshold: PT5M
+  webhook:
+    github:
+      # GitHub webhook secret. Used to verify the signature of incoming webhook requests.
+      secret: 123456
+
+      # GitHub usernames allowed to trigger webhook events.
+      allowed-users: [ octocat, onixbyte ]
+
+springdoc:
+  api-docs:
+    # Whether to expose the OpenAPI documentation. Set to `false` if you do not need it
+    # (recommended in production mode).
+    enabled: true
+  swagger-ui:
+    # Whether to expose the Swagger UI. Set to `false` if you do not need it
+    # (recommended in production mode).
+    enabled: true