init: 클린 기반 auth 서버 설계

2026-07-24 14:30:18 +09:00
parent 471db0203d
commit 8a1ac1e769
3642 changed files with 275893 additions and 1 deletions
@@ -0,0 +1,29 @@
+spring:
+  config:
+    activate:
+      on-profile: dev
+  datasource:
+    url: ${APP_DATASOURCE_URL}
+    username: ${APP_DATASOURCE_USERNAME}
+    password: ${APP_DATASOURCE_PASSWORD}
+    driver-class-name: org.postgresql.Driver
+  jpa:
+    hibernate:
+      ddl-auto: validate
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${APP_SECURITY_KEYCLOAK_ISSUER_URI}
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info,loggers,httpexchanges
+  endpoint:
+    health:
+      show-details: when-authorized
+  server:
+    address: 127.0.0.1
+    port: ${MANAGEMENT_SERVER_PORT:9090}
@@ -0,0 +1,17 @@
+spring:
+  config:
+    activate:
+      on-profile: local
+  datasource:
+    url: ${APP_DATASOURCE_URL:jdbc:postgresql://localhost:5432/project_auth}
+    username: ${APP_DATASOURCE_USERNAME:project_auth}
+    password: ${APP_DATASOURCE_PASSWORD:project_auth}
+    driver-class-name: ${APP_DATASOURCE_DRIVER_CLASS_NAME:org.postgresql.Driver}
+  jpa:
+    hibernate:
+      ddl-auto: validate
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${APP_SECURITY_KEYCLOAK_ISSUER_URI:http://localhost:8081/realms/project-auth}
@@ -0,0 +1,22 @@
+spring:
+  config:
+    activate:
+      on-profile: prod
+  datasource:
+    url: ${APP_DATASOURCE_URL}
+    username: ${APP_DATASOURCE_USERNAME}
+    password: ${APP_DATASOURCE_PASSWORD}
+    driver-class-name: org.postgresql.Driver
+  jpa:
+    hibernate:
+      ddl-auto: validate
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${APP_SECURITY_KEYCLOAK_ISSUER_URI}
+
+logging:
+  structured:
+    format:
+      console: logstash
@@ -0,0 +1,60 @@
+spring:
+  application:
+    name: project-auth-server
+  profiles:
+    default: local
+  flyway:
+    enabled: false
+  jpa:
+    open-in-view: false
+    properties:
+      hibernate:
+        format_sql: true
+        default_schema: auth
+        jdbc:
+          time_zone: UTC
+server:
+  forward-headers-strategy: native
+  tomcat:
+    remoteip:
+      internal-proxies: '${SERVER_TOMCAT_REMOTEIP_INTERNAL_PROXIES:10\.[0-9]+\.[0-9]+\.[0-9]+|192\.168\.[0-9]+\.[0-9]+|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]+\.[0-9]+|127\.[0-9]+\.[0-9]+\.[0-9]+}'
+
+app:
+  docs:
+    title: ${APP_DOCS_TITLE:Project Auth Server API}
+    description: ${APP_DOCS_DESCRIPTION:인증 서버의 OpenAPI 문서입니다.}
+    version: ${APP_DOCS_VERSION:v1}
+  logging:
+    audit:
+      file: ${APP_LOGGING_AUDIT_FILE:./logs/audit/auth.log}
+      max-history: ${APP_LOGGING_AUDIT_MAX_HISTORY:30}
+      max-file-size: ${APP_LOGGING_AUDIT_MAX_FILE_SIZE:50MB}
+      total-size-cap: ${APP_LOGGING_AUDIT_TOTAL_SIZE_CAP:2GB}
+    access:
+      excluded-path-prefixes:
+        - /actuator
+        - /livez
+        - /readyz
+        - /swagger-ui
+        - /v3/api-docs
+        - /favicon.ico
+  persistence:
+    migration:
+      location: ${APP_PERSISTENCE_MIGRATION_LOCATION:classpath:db/migration}
+      schema: ${APP_PERSISTENCE_MIGRATION_SCHEMA:auth}
+
+springdoc:
+  swagger-ui:
+    path: /swagger-ui.html
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health
+  endpoint:
+    health:
+      show-details: never
+      probes:
+        enabled: true
+        add-additional-paths: true
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
+
+    <property name="CONSOLE_LOG_PATTERN"
+              value="%clr(%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr([traceId=%X{traceId:-}]){yellow} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m %kvp%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}"/>
+
+    <springProperty scope="context" name="AUDIT_FILE_PATH" source="app.logging.audit.file"
+                    defaultValue="./logs/audit/auth.log"/>
+    <springProperty scope="context" name="AUDIT_MAX_HISTORY" source="app.logging.audit.max-history"
+                    defaultValue="30"/>
+    <springProperty scope="context" name="AUDIT_MAX_FILE_SIZE" source="app.logging.audit.max-file-size"
+                    defaultValue="50MB"/>
+    <springProperty scope="context" name="AUDIT_TOTAL_SIZE_CAP" source="app.logging.audit.total-size-cap"
+                    defaultValue="2GB"/>
+
+    <property name="AUDIT_FILE_PATTERN"
+              value="%d{yyyy-MM-dd'T'HH:mm:ss.SSSXXX} %-5level [%thread] [%logger{36}] [traceId=%X{traceId:-} clientIp=%X{clientIp:-} userAgent=%X{userAgent:-}] %msg %kvp%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}"/>
+
+    <!-- Default: plain console appender (local, dev, test, and any unspecified profile) -->
+    <springProfile name="!prod">
+        <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
+    </springProfile>
+
+    <!-- prod: JSON structured console appender -->
+    <springProfile name="prod">
+        <include resource="org/springframework/boot/logging/logback/structured-console-appender.xml"/>
+    </springProfile>
+
+    <springProfile name="audit-file">
+        <appender name="AUDIT_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+            <file>${AUDIT_FILE_PATH}</file>
+            <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+                <pattern>${AUDIT_FILE_PATTERN}</pattern>
+                <charset>UTF-8</charset>
+            </encoder>
+            <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
+                <fileNamePattern>${AUDIT_FILE_PATH}.%d{yyyy-MM-dd}.%i.gz</fileNamePattern>
+                <maxFileSize>${AUDIT_MAX_FILE_SIZE}</maxFileSize>
+                <maxHistory>${AUDIT_MAX_HISTORY}</maxHistory>
+                <totalSizeCap>${AUDIT_TOTAL_SIZE_CAP}</totalSizeCap>
+            </rollingPolicy>
+        </appender>
+    </springProfile>
+
+    <!-- Audit logger: console is the default source of truth. File logging is opt-in via the audit-file profile. -->
+    <springProfile name="!audit-file">
+        <logger name="audit.auth" level="INFO" additivity="false">
+            <appender-ref ref="CONSOLE"/>
+        </logger>
+    </springProfile>
+
+    <springProfile name="audit-file">
+        <logger name="audit.auth" level="INFO" additivity="false">
+            <appender-ref ref="CONSOLE"/>
+            <appender-ref ref="AUDIT_FILE"/>
+        </logger>
+    </springProfile>
+
+    <!-- Access logger (all profiles) -->
+    <logger name="http.access" level="INFO" additivity="false">
+        <appender-ref ref="CONSOLE"/>
+    </logger>
+
+    <!-- local profile: default + hibernate SQL debug -->
+    <springProfile name="local">
+        <logger name="org.hibernate.SQL" level="DEBUG"/>
+    </springProfile>
+
+    <!-- dev profile: selective debug -->
+    <springProfile name="dev">
+        <logger name="com.project.auth" level="DEBUG"/>
+        <logger name="org.hibernate.SQL" level="DEBUG"/>
+        <logger name="org.springframework.security" level="INFO"/>
+    </springProfile>
+
+    <!-- prod profile: noisy package suppression -->
+    <springProfile name="prod">
+        <logger name="org.hibernate" level="WARN"/>
+        <logger name="org.springframework.security" level="WARN"/>
+        <logger name="org.flywaydb" level="WARN"/>
+    </springProfile>
+
+    <root level="INFO">
+        <appender-ref ref="CONSOLE"/>
+    </root>
+</configuration>
@@ -0,0 +1,28 @@
+spring:
+  datasource:
+    url: jdbc:h2:mem:project-auth-server;MODE=PostgreSQL;DATABASE_TO_LOWER=TRUE;DEFAULT_NULL_ORDERING=HIGH;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
+    username: sa
+    password:
+    driver-class-name: org.h2.Driver
+  jpa:
+    open-in-view: false
+    hibernate:
+      ddl-auto: none
+    properties:
+      hibernate:
+        default_schema: auth
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: http://localhost:8180/realms/test
+
+app:
+  docs:
+    title: Project Auth Server API Test
+    description: 테스트용 OpenAPI 문서 설정입니다.
+    version: test
+  persistence:
+    migration:
+      location: classpath:db/migration
+      schema: auth