mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-04-23 04:06:21 +08:00
f4cbdc3a3b
## Summary Fixes MinIO SSL/TLS support in two places: the MinIO **client** connection and the **health check** used by the Admin/Service Health dashboard. Both now respect the `secure` and `verify` settings from the MinIO configuration. Closes #13158 Closes #13159 --- ## Problem **#13158 – MinIO client:** The client in `rag/utils/minio_conn.py` was hardcoded with `secure=False`, so RAGFlow could not connect to MinIO over HTTPS even when `secure: true` was set in config. There was also no way to disable certificate verification for self-signed certs. **#13159 – MinIO health check:** In `api/utils/health_utils.py`, the MinIO liveness check always used `http://` for the health URL. When MinIO was configured with SSL, the health check failed and the dashboard showed "timeout" even though MinIO was reachable over HTTPS. --- ## Solution ### MinIO client (`rag/utils/minio_conn.py`) - Read `MINIO.secure` (default `false`) and pass it into the `Minio()` constructor so HTTPS is used when configured. - Add `_build_minio_http_client()` that reads `MINIO.verify` (default `true`). When `verify` is false, return an `urllib3.PoolManager` with `cert_reqs=ssl.CERT_NONE` and pass it as `http_client` to `Minio()` so self-signed certificates are accepted. - Support string values for `secure` and `verify` (e.g. `"true"`, `"false"`). ### MinIO health check (`api/utils/health_utils.py`) - Add `_minio_scheme_and_verify()` to derive URL scheme (http/https) and the `verify` flag from `MINIO.secure` and `MINIO.verify`. - Update `check_minio_alive()` to use the correct scheme, pass `verify` into `requests.get(..., verify=verify)`, and use `timeout=10`. ### Config template (`docker/service_conf.yaml.template`) - Add commented optional MinIO keys `secure` and `verify` (and env vars `MINIO_SECURE`, `MINIO_VERIFY`) so deployers know they can enable HTTPS and optional cert verification. ### Tests - **`test/unit_test/utils/test_health_utils_minio.py`** – Tests for `_minio_scheme_and_verify()` and `check_minio_alive()` (scheme, verify, status codes, timeout, errors). - **`test/unit_test/utils/test_minio_conn_ssl.py`** – Tests for `_build_minio_http_client()` (verify true/false/missing, string values, `CERT_NONE` when verify is false). --- ## Testing - Unit tests added/updated as above; run with the project's test runner. - Manually: configure MinIO with HTTPS and `secure: true` (and optionally `verify: false` for self-signed); confirm client operations work and the Service Health dashboard shows MinIO as alive instead of timeout.
171 lines
5.2 KiB
Plaintext
171 lines
5.2 KiB
Plaintext
ragflow:
|
|
host: ${RAGFLOW_HOST:-0.0.0.0}
|
|
http_port: 9380
|
|
admin:
|
|
host: ${RAGFLOW_HOST:-0.0.0.0}
|
|
http_port: 9381
|
|
mysql:
|
|
name: '${MYSQL_DBNAME:-rag_flow}'
|
|
user: '${MYSQL_USER:-root}'
|
|
password: '${MYSQL_PASSWORD:-infini_rag_flow}'
|
|
host: '${MYSQL_HOST:-mysql}'
|
|
port: ${MYSQL_PORT:-3306}
|
|
max_connections: 900
|
|
stale_timeout: 300
|
|
max_allowed_packet: ${MYSQL_MAX_PACKET:-1073741824}
|
|
minio:
|
|
user: '${MINIO_USER:-rag_flow}'
|
|
password: '${MINIO_PASSWORD:-infini_rag_flow}'
|
|
host: '${MINIO_HOST:-minio}:9000'
|
|
bucket: '${MINIO_BUCKET:-}'
|
|
prefix_path: '${MINIO_PREFIX_PATH:-}'
|
|
# optional: set to true for HTTPS (SSL/TLS). Used by MinIO client and health check.
|
|
# secure: ${MINIO_SECURE:-false}
|
|
# optional: set to false to allow self-signed certificates (e.g. in development).
|
|
# verify: ${MINIO_VERIFY:-true}
|
|
es:
|
|
hosts: 'http://${ES_HOST:-es01}:9200'
|
|
username: '${ES_USER:-elastic}'
|
|
password: '${ELASTIC_PASSWORD:-infini_rag_flow}'
|
|
os:
|
|
hosts: 'http://${OS_HOST:-opensearch01}:9201'
|
|
username: '${OS_USER:-admin}'
|
|
password: '${OPENSEARCH_PASSWORD:-infini_rag_flow_OS_01}'
|
|
infinity:
|
|
uri: '${INFINITY_HOST:-infinity}:23817'
|
|
postgres_port: 5432
|
|
db_name: 'default_db'
|
|
oceanbase:
|
|
scheme: 'oceanbase' # set 'mysql' to create connection using mysql config
|
|
config:
|
|
db_name: '${OCEANBASE_DOC_DBNAME:-test}'
|
|
user: '${OCEANBASE_USER:-root@ragflow}'
|
|
password: '${OCEANBASE_PASSWORD:-infini_rag_flow}'
|
|
host: '${OCEANBASE_HOST:-oceanbase}'
|
|
port: ${OCEANBASE_PORT:-2881}
|
|
seekdb:
|
|
scheme: 'oceanbase' # SeekDB is the lite version of OceanBase
|
|
config:
|
|
db_name: '${SEEKDB_DOC_DBNAME:-ragflow_doc}'
|
|
user: '${SEEKDB_USER:-root}'
|
|
password: '${SEEKDB_PASSWORD:-infini_rag_flow}'
|
|
host: '${SEEKDB_HOST:-seekdb}'
|
|
port: ${SEEKDB_PORT:-2881}
|
|
redis:
|
|
db: 1
|
|
username: '${REDIS_USERNAME:-}'
|
|
password: '${REDIS_PASSWORD:-infini_rag_flow}'
|
|
host: '${REDIS_HOST:-redis}:6379'
|
|
user_default_llm:
|
|
default_models:
|
|
embedding_model:
|
|
api_key: 'xxx'
|
|
base_url: 'http://${TEI_HOST}:80'
|
|
# postgres:
|
|
# name: '${POSTGRES_DBNAME:-rag_flow}'
|
|
# user: '${POSTGRES_USER:-rag_flow}'
|
|
# password: '${POSTGRES_PASSWORD:-infini_rag_flow}'
|
|
# host: '${POSTGRES_HOST:-postgres}'
|
|
# port: 5432
|
|
# max_connections: 100
|
|
# stale_timeout: 30
|
|
# s3:
|
|
# access_key: 'access_key'
|
|
# secret_key: 'secret_key'
|
|
# region: 'region'
|
|
# endpoint_url: 'endpoint_url'
|
|
# bucket: 'bucket'
|
|
# prefix_path: 'prefix_path'
|
|
# signature_version: 'v4'
|
|
# addressing_style: 'path'
|
|
# oss:
|
|
# access_key: '${ACCESS_KEY}'
|
|
# secret_key: '${SECRET_KEY}'
|
|
# endpoint_url: '${ENDPOINT}'
|
|
# region: '${REGION}'
|
|
# bucket: '${BUCKET}'
|
|
# prefix_path: '${OSS_PREFIX_PATH}'
|
|
# signature_version: 's3'
|
|
# addressing_style: 'virtual'
|
|
# azure:
|
|
# auth_type: 'sas'
|
|
# container_url: 'container_url'
|
|
# sas_token: 'sas_token'
|
|
# azure:
|
|
# auth_type: 'spn'
|
|
# account_url: 'account_url'
|
|
# client_id: 'client_id'
|
|
# secret: 'secret'
|
|
# tenant_id: 'tenant_id'
|
|
# container_name: 'container_name'
|
|
# The OSS object storage uses the MySQL configuration above by default. If you need to switch to another object storage service, please uncomment and configure the following parameters.
|
|
# opendal:
|
|
# scheme: 'mysql' # Storage type, such as s3, oss, azure, etc.
|
|
# config:
|
|
# oss_table: 'opendal_storage'
|
|
# user_default_llm:
|
|
# factory: 'BAAI'
|
|
# api_key: 'backup'
|
|
# base_url: 'backup_base_url'
|
|
# default_models:
|
|
# chat_model:
|
|
# name: 'qwen2.5-7b-instruct'
|
|
# factory: 'xxxx'
|
|
# api_key: 'xxxx'
|
|
# base_url: 'https://api.xx.com'
|
|
# embedding_model:
|
|
# name: 'bge-m3'
|
|
# rerank_model: 'bge-reranker-v2'
|
|
# asr_model:
|
|
# model: 'whisper-large-v3' # alias of name
|
|
# image2text_model: ''
|
|
# oauth:
|
|
# oauth2:
|
|
# display_name: "OAuth2"
|
|
# client_id: "your_client_id"
|
|
# client_secret: "your_client_secret"
|
|
# authorization_url: "https://your-oauth-provider.com/oauth/authorize"
|
|
# token_url: "https://your-oauth-provider.com/oauth/token"
|
|
# userinfo_url: "https://your-oauth-provider.com/oauth/userinfo"
|
|
# redirect_uri: "https://your-app.com/v1/user/oauth/callback/oauth2"
|
|
# oidc:
|
|
# display_name: "OIDC"
|
|
# client_id: "your_client_id"
|
|
# client_secret: "your_client_secret"
|
|
# issuer: "https://your-oauth-provider.com/oidc"
|
|
# scope: "openid email profile"
|
|
# redirect_uri: "https://your-app.com/v1/user/oauth/callback/oidc"
|
|
# github:
|
|
# type: "github"
|
|
# icon: "github"
|
|
# display_name: "Github"
|
|
# client_id: "your_client_id"
|
|
# client_secret: "your_client_secret"
|
|
# redirect_uri: "https://your-app.com/v1/user/oauth/callback/github"
|
|
# authentication:
|
|
# client:
|
|
# switch: false
|
|
# http_app_key:
|
|
# http_secret_key:
|
|
# site:
|
|
# switch: false
|
|
# permission:
|
|
# switch: false
|
|
# component: false
|
|
# dataset: false
|
|
# smtp:
|
|
# mail_server: ""
|
|
# mail_port: 465
|
|
# mail_use_ssl: true
|
|
# mail_use_tls: false
|
|
# mail_username: ""
|
|
# mail_password: ""
|
|
# mail_default_sender:
|
|
# - "RAGFlow" # display name
|
|
# - "" # sender email address
|
|
# mail_frontend_url: "https://your-frontend.example.com"
|
|
# tcadp_config:
|
|
# secret_id: '${TENCENT_SECRET_ID}'
|
|
# secret_key: '${TENCENT_SECRET_KEY}'
|
|
# region: '${TENCENT_REGION}'
|