imbajin commented on code in PR #501:
URL: https://github.com/apache/hugegraph-doc/pull/501#discussion_r4114805004
##########
content/cn/docs/quickstart/computing/hugegraph-vermeer.md:
##########
@@ -39,37 +80,33 @@ services:
ports:
- "6688:6688"
Review Comment:
Fixed in ccdfcf898. Both Compose and docker run now publish the master HTTP
API on 127.0.0.1 only. The warning states that auth=none leaves regular and
admin APIs unauthenticated and requires token authentication or a protected
network/gateway before remote access.
##########
content/cn/docs/quickstart/hugegraph/hugegraph-server.md:
##########
@@ -302,89 +354,102 @@ curl http://localhost:8081/graphspaces/DEFAULT/graphs
bin/stop-hugegraph.sh
```
-##### Docker 分布式集群
-
-通过 Docker-Compose 运行完整的分布式集群（3 PD + 3 Store + 3 Server）：
+##### Docker HStore 高可用集群（当前主线）
+`docker-compose-3pd-3store-3server.yml` 使用当前主线的 `HG_PD_*`、`HG_STORE_*` 和
`HG_SERVER_*` 环境变量；1.7.0 发布镜像不支持这套配置。先从同一份主线源码构建 PD、Store 和 Server 镜像，并使用相同的本地
`local` 标签：
```bash
-cd hugegraph/docker
-HUGEGRAPH_VERSION=1.7.0 docker compose -f
docker-compose-3pd-3store-3server.yml up -d --wait
+# 在 hugegraph 仓库根目录执行
+docker build -f hugegraph-pd/Dockerfile -t hugegraph/pd:local .
+docker build -f hugegraph-store/Dockerfile -t hugegraph/store:local .
+docker build -f hugegraph-server/Dockerfile-hstore -t hugegraph/server:local .
+
+cd docker
```
-服务通过 `hg-net` 桥接网络上的容器主机名进行通信。配置通过环境变量注入：
+先在 `docker/` 目录创建认证环境并生成 HStore Hubble 配置。用自己设置的管理员密码替换示例文本；因 `.env`
使用单引号包裹，密码不能含单引号或换行。脚本生成 JWT 与 PD 随机密钥，并将 PD 密钥写入两个 HStore Compose 会挂载的未跟踪
`.local.properties` 文件：
-```yaml
-# Server 配置，server0、server1、server2 共用
-HG_SERVER_BACKEND: hstore
-HG_SERVER_PD_PEERS: pd0:8686,pd1:8686,pd2:8686
-HG_SERVER_CLUSTER: hg
-HG_SERVER_USE_PD: "true"
-HG_SERVER_MIN_FREE_MEMORY: "0"
-HG_SERVER_INIT_STORE_ENABLED: "false"
-HG_SERVER_REQUIRE_AUTH_TOKEN_SECRET: "true"
-STORE_REST: store0:8520
-# 每个节点单独设置，例如 server0
-HG_SERVER_REST_URL: http://server0:8080
+```bash
+(
+ set -eu
+ command -v openssl >/dev/null
+ jwt_secret="$(openssl rand -hex 32)"
+ pd_secret="$(openssl rand -hex 24)"
+ umask 077
+ test ! -e .env || {
+ echo ".env already exists; edit it instead of overwriting it" >&2
+ exit 1
+ }
+ printf
"HUGEGRAPH_ADMIN_PASSWORD='%s'\nHUGEGRAPH_AUTH_TOKEN_SECRET='%s'\nHG_PD_AUTH_SECRET_KEY='%s'\n"
\
+ 'replace-with-your-password' "${jwt_secret}" "${pd_secret}" > .env
+ HG_PD_AUTH_SECRET_KEY="${pd_secret}" ./set-hubble-pd-password.sh hstore
Review Comment:
Fixed in ccdfcf898. The highlighted warning explicitly states that the
helper sets the generated files to 0644, so umask protects only the new .env.
It limits this recipe to hosts with trusted local users and requires
runtime-aware ownership/read permissions on shared hosts.
##########
content/cn/docs/config/config-option.md:
##########
@@ -115,6 +113,18 @@ HStore 后端还会从图配置文件 `{graph-name}.properties` 中读取以下
| hstore.partition_count | 0 | Number of partitions, which PD
controls partitions based on. |
| hstore.shard_count | 0 | Number of copies, which PD
controls partition copies based on. |
+### 认证数据图配置项
+
+以下选项写在 `auth.graph_store` 指定图的 properties 文件中，默认文件为
`conf/graphs/hugegraph.properties`。`auth.authenticator`、`auth.graph_store`、`auth.admin_pa`
和 `auth.remote_url` 则配置在上方的 `rest-server.properties` 表中。
+
+| config option | default value | description |
+|---------------|---------------|-------------|
+| auth.audit_log_rate | 1000.0
| 每用户认证审计日志的最大输出速率，单位为条/秒，取值为非负数。
|
Review Comment:
Fixed in ccdfcf898. The Chinese and English option tables now document
integer truncation, including 1.9 becoming 1 and 0 or values below 1
suppressing audit output. They recommend positive integer limits to retain
audit records.
##########
content/cn/docs/config/config-guide.md:
##########
@@ -19,125 +19,41 @@ HugeGraphServer 内部集成了 GremlinServer 和 RestServer，而
gremlin-serve
下面对这三个配置文件逐一介绍。
+> [!WARNING]
+> **生产环境必须配置 Server 鉴权与网络边界**
+>
+> 本页的认证配置属于 HugeGraph Server。生产环境必须按 [Server
认证与授权配置](/cn/docs/config/config-authentication/)启用 Auth、配置 IP 白名单和最小权限，并保留、保护
Server `audit-*.log`。示例中注释掉的认证配置表示默认未启用。
+
+发行包把默认配置放在安装目录的 `conf/` 下；这些文件来自 Server
仓库的静态发行素材，构建时随包复制。未在配置文件中出现的选项采用代码定义的默认值；配置文件显式写入的值会覆盖该默认值。
+本页的默认文件行为按固定 Server 主线 `2f827d6` 核对；实际使用的发布包应以其自身版本对应的配置文件和入口脚本为准。
+
+| 文件 | 来源和用途 | 装载行为 |
+|------|------------|----------|
+| `conf/gremlin-server.yaml` | 随发行包提供；配置 Gremlin Server。 |
`start-hugegraph.sh` 将它作为 Server 启动参数传入。 |
+| `conf/rest-server.properties` | 按固定 Server 主线构建时随发行包提供；配置 REST
Server、PD、认证等。 | 启动脚本和 Server 进程读取；对应主线构建的容器入口脚本也会在启动前更新其中受支持的选项。 |
+| `conf/graphs/hugegraph.properties` | 随发行包提供的默认图配置，使用 RocksDB。 |
`init-store.sh` 和 Server
应用初始化都会扫描该目录；初始化阶段会尝试加载其中的图配置。`graph.load_from_local_config` 默认
`false`，只控制管理器构造阶段预加载及 `reload()` 重扫。 |
Review Comment:
Fixed in ccdfcf898. The English configuration guide and option table now
match the Chinese startup semantics: the flag controls constructor preloading
and reload rescans, while application initialization still scans local
configurations when it is false. The multi-graph example also labels true as
optional.
##########
content/cn/docs/guides/backup-restore.md:
##########
@@ -46,27 +46,23 @@ Restore 有两种模式： RESTORING 和 MERGING，恢复之前首先要根据
```bash
bin/hugegraph graph-mode-get
-```
-该命令用于查看当前图模式，包括：NONE、RESTORING、MERGING、LOADING。
+``` 该命令用于查看当前图模式，包括：NONE、RESTORING、MERGING、LOADING。
Review Comment:
Fixed in ccdfcf898. All four malformed closing fences are now standalone,
with their explanations in following paragraphs. The rendered page was checked
to ensure those explanations are outside code blocks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
