jumpserver · baijiangjie · Aug 20, 2026 · Jul 16, 2026 · Jul 16, 2026 · Jul 16, 2026
diff --git a/.gitignore b/.gitignore
@@ -15,4 +15,5 @@ cofnig.link
 .bak
 config.link
 release/*
-.history/
+.history/
+config_init/nginx/cert/
diff --git a/README.md b/README.md
@@ -36,6 +36,25 @@ $ ./jmsctl.sh tail
 
 ```
 
+## KOTL（企业版）
+
+KOTL 是企业版组件，需要在 `/opt/jumpserver/config/config.txt` 中设置
+`USE_XPACK=1`。它作为宿主机 systemd 服务安装，不加入 Docker Compose；企业版中
+默认启用，如需关闭可设置：
+
+```bash
+KOTL_ENABLED=0
+```
+
+安装器会拉取 `${NAMESPACE:-jumpserver}/kotl:${VERSION}` artifact 镜像，从
+`/dist` 提取并执行 KOTL 自带的 `scripts/install.sh` 或 `scripts/upgrade.sh`。
+离线包也会自动包含该镜像。服务跟随 `jmsctl.sh start/stop/restart/status`
+管理，日志可通过 `./jmsctl.sh tail kotl` 查看。启用时还会自动为 Core 配置
+`KOTL_ENABLED=1`、`JDMC_ENABLED=1` 和 `/opt/jumpserver/data/unshare/kotl.sock`。
+
+当前 KOTL 的宿主机路径固定使用 `/data/jumpserver`，因此启用时
+`VOLUME_DIR` 也必须保持为 `/data/jumpserver`。
+
 ## 配置文件说明
 
 配置文件将会放在 /opt/jumpserver/config 中

diff --git a/compose/magnus.yml b/compose/magnus.yml
@@ -9,13 +9,7 @@ services:
     env_file:
       - ${CONFIG_SAFE_FILE}
     ports:
-      - ${MAGNUS_MYSQL_PORT:-33061}:33061
-      - ${MAGNUS_MARIADB_PORT:-33062}:33062
-      - ${MAGNUS_REDIS_PORT:-63790}:63790
-      - ${MAGNUS_POSTGRESQL_PORT:-54320}:54320
-      - ${MAGNUS_SQLSERVER_PORT:-14330}:14330
-      - ${MAGNUS_ORACLE_PORT:-15210}:15210
-      - ${MAGNUS_MONGODB_PORT:-27018}:27018
+      - ${MAGNUS_PORT:-5525}:5525
     volumes:
       - ${CONFIG_DIR}/certs:/opt/magnus/data/certs
       - ${VOLUME_DIR}/magnus/data:/opt/magnus/data

diff --git a/compose/mysql.yml b/compose/mysql.yml
@@ -1,6 +1,6 @@
 services:
   mysql:
-    image: mysql:5.7-debian
+    image: mysql:8.0
     container_name: jms_mysql
     restart: always
     command: --character-set-server=utf8

diff --git a/compose/openbao.yml b/compose/openbao.yml
@@ -0,0 +1,60 @@
+services:
+  core:
+    depends_on:
+      openbao-init:
+        condition: service_completed_successfully
+
+  celery:
+    depends_on:
+      openbao-init:
+        condition: service_completed_successfully
+
+  openbao:
+    image: openbao:2.6.0
+    container_name: jms_openbao
+    hostname: openbao
+    # Start the image entrypoint as root so it can fix bind-mount ownership;
+    # the official entrypoint then launches bao via su-exec as openbao.
+    user: "0"
+    restart: always
+    command: server -config=/openbao/config/server.hcl
+    environment:
+      BAO_ADDR: http://127.0.0.1:8200
+      VAULT_API_ADDR: ${OPENBAO_RAFT_API_ADDR:-http://openbao:8200}
+      VAULT_CLUSTER_ADDR: ${OPENBAO_RAFT_CLUSTER_ADDR:-http://openbao:8201}
+      VAULT_RAFT_NODE_ID: ${OPENBAO_RAFT_NODE_ID:-openbao}
+      TZ: ${TZ:-Asia/Shanghai}
+    volumes:
+      - ${CONFIG_DIR}/openbao/server.hcl:/openbao/config/server.hcl:ro
+      - ${VOLUME_DIR}/openbao/data:/openbao/file
+    ports:
+      - "${OPENBAO_UI_BIND:-127.0.0.1}:${OPENBAO_UI_PORT:-8200}:8200"
+      - "${OPENBAO_CLUSTER_BIND:-127.0.0.1}:${OPENBAO_CLUSTER_PORT:-8201}:8201"
+    healthcheck:
+      test: "bao status -address=http://127.0.0.1:8200"
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    networks:
+      - net
+
+  openbao-init:
+    image: openbao:2.6.0
+    container_name: jms_openbao_init
+    hostname: openbao-init
+    # The one-shot initializer writes root-owned 0600 unseal material.
+    user: "0"
+    restart: "no"
+    command: sh /openbao/bootstrap/bootstrap.sh
+    env_file:
+      - ${CONFIG_FILE}
+    environment:
+      BAO_ADDR: http://openbao:8200
+      TZ: ${TZ:-Asia/Shanghai}
+    volumes:
+      - ${CONFIG_DIR}/openbao:/openbao/bootstrap
+    depends_on:
+      - openbao
+    networks:
+      - net
diff --git a/compose/postgresql.yml b/compose/postgresql.yml
@@ -1,6 +1,6 @@
 services:
   postgresql:
-    image: postgres:16.10-bookworm
+    image: postgres:16.15-bookworm
     container_name: jms_postgresql
     restart: always
     environment:
@@ -17,4 +17,4 @@ services:
       retries: 3
       start_period: 30s
     networks:
-      - net
+      - net
diff --git a/compose/redis.yml b/compose/redis.yml
@@ -1,6 +1,6 @@
 services:
   redis:
-    image: redis:7.4.6-bookworm
+    image: redis:7.4.10-bookworm
     container_name: jms_redis
     hostname: jms_redis
     restart: always

diff --git a/compose/web.yml b/compose/web.yml
@@ -24,6 +24,7 @@ services:
       KAEL_ENABLED: ${KAEL_ENABLED:-0}
       RAZOR_ENABLED: ${RAZOR_ENABLED:-1}
       FACELIVE_ENABLED: ${FACELIVE_ENABLED:-0}
+      KOTL_ENABLED: ${KOTL_ENABLED:-0}
       BASIC_AUTH_PASSWORD: ${BASIC_AUTH_PASSWORD:-}
     volumes:
       - ${VOLUME_DIR}/core/data:/opt/jumpserver/data
@@ -36,4 +37,6 @@ services:
       retries: 3
       start_period: 90s
     networks:
-      - net
+      - net
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
diff --git a/compose/xrdp.yml b/compose/xrdp.yml
@@ -14,10 +14,10 @@ services:
       - ${VOLUME_DIR}/xrdp/data:/opt/xrdp/data
       - ${CONFIG_DIR}/nginx/cert:/opt/xrdp/cert
     healthcheck:
-      test: "nc -z 127.0.0.1 $$XRDP_PORT || exit 1"
+      test: "nc -z 127.0.0.1 3390 || exit 1"
       interval: 10s
       timeout: 5s
       retries: 3
       start_period: 10s
     networks:
-      - net
+      - net
diff --git a/config-example.txt b/config-example.txt
@@ -129,22 +129,22 @@ DOMAINS=
 # CHEN_ENABLED=0
 # WEB_ENABLED=0
 
+# KOTL is an Enterprise Edition host management console. It is distributed as
+# an artifact image, then installed as a systemd service on the host instead of
+# running in Compose. It requires USE_XPACK=1 and can be disabled with:
+# KOTL_ENABLED=0
+
 # Lion enables font smoothing to optimize the experience
 #
 JUMPSERVER_ENABLE_FONT_SMOOTHING=true
 
 ################################# XPack Configuration #################################
 # XPack package, invalid setting in open source version
 #
-SSH_PORT=2222
-RDP_PORT=3389
+KOKO_SSH_PORT=2222
+RAZOR_RDP_PORT=3389
 XRDP_PORT=3390
-MAGNUS_MYSQL_PORT=33061
-MAGNUS_MARIADB_PORT=33062
-MAGNUS_REDIS_PORT=63790
-MAGNUS_POSTGRESQL_PORT=54320
-MAGNUS_SQLSERVER_PORT=14330
-MAGNUS_ORACLE_PORT=15210
+MAGNUS_PORT=5525
 
 #XRDP_ENABLED=1
 
@@ -162,3 +162,36 @@ USE_LB=1
 #
 TZ=Asia/Shanghai
 CURRENT_VERSION=
+
+################################# Vault Configuration #################################
+# OpenBao runs as an independent Docker service in this installer. JumpServer connects to OpenBao Server directly.
+# OpenBao 作为独立 Docker 服务部署，JumpServer 直接访问 OpenBao Server。
+#
+# Disabled by default. Set to true to enable Vault storage. When the backend is
+# openbao and OPENBAO_EXTERNAL=false, the installer starts the built-in service.
+# 默认关闭；设为 true 后启用 Vault。当后端为 openbao 且 OPENBAO_EXTERNAL=false 时，安装器启动内置服务。
+VAULT_ENABLED=false
+VAULT_BACKEND=openbao
+VAULT_OPENBAO_ADDR=http://openbao:8200
+VAULT_OPENBAO_MOUNT_POINT=pam
+VAULT_OPENBAO_TOKEN=
+VAULT_OPENBAO_TIMEOUT=10
+
+# Set to true when VAULT_OPENBAO_ADDR points to an external OpenBao cluster or HA endpoint.
+# 设置为 true 时，installer 不会启动内置 OpenBao，Core 仍使用上面的 Vault 配置连接外部服务。
+OPENBAO_EXTERNAL=false
+
+OPENBAO_RAFT_NODE_ID=openbao
+OPENBAO_RAFT_API_ADDR=http://openbao:8200
+OPENBAO_RAFT_CLUSTER_ADDR=http://openbao:8201
+OPENBAO_RAFT_BOOTSTRAP=true
+# Additional Raft nodes must set OPENBAO_RAFT_BOOTSTRAP=false and receive a
+# protected copy of openbao/init.json from the bootstrap node before startup.
+# OPENBAO_RAFT_RETRY_JOIN=http://openbao-1:8200,http://openbao-2:8200
+
+OPENBAO_UNSEAL_KEY_SHARES=5
+OPENBAO_UNSEAL_KEY_THRESHOLD=3
+OPENBAO_UI_BIND=127.0.0.1
+OPENBAO_UI_PORT=8200
+OPENBAO_CLUSTER_BIND=127.0.0.1
+OPENBAO_CLUSTER_PORT=8201
diff --git a/config_init/nginx/cert/server.crt b/config_init/nginx/cert/server.crt
diff --git a/config_init/nginx/cert/server.key b/config_init/nginx/cert/server.key
diff --git a/config_init/nginx/lb_http_server.conf b/config_init/nginx/lb_http_server.conf
@@ -8,7 +8,7 @@ server {
   listen 80;
   # listen [::]:80;
   # server_name demo.jumpserver.org;  # 取消注释并自行修改成你自己的域名
-  return 307 https://$server_name$request_uri;
+  return 307 https://$host$request_uri;
 }
 
 server {