From 6e653dc0efeabf631fa17ff579f713f5b1450908 Mon Sep 17 00:00:00 2001 From: tianM <46552064+a3384379@users.noreply.github.com> Date: Thu, 24 Sep 2026 22:06:45 +0800 Subject: [PATCH 1/3] Unify default admin login across FlowTest deployments --- .env.example | 2 +- README.md | 15 ++++--- backend/app/core/config.py | 4 +- backend/app/services/auth.py | 2 +- backend/tests/test_access_api.py | 43 ++++++++----------- backend/tests/test_governance.py | 12 +++++- compose.yaml | 2 +- deploy/compact/README.md | 13 +++--- deploy/compact/generate_env.sh | 3 +- deploy/standalone/.env.example | 4 +- deploy/standalone/README.md | 5 +-- deploy/standalone/preflight.ps1 | 2 +- deploy/standalone/start.ps1 | 6 +-- deploy/upgrade/compose.yaml | 2 +- ...runtime-profiles-and-compact-deployment.md | 3 ++ ...055-unified-default-administrator-login.md | 21 +++++++++ docs/adr/README.md | 1 + docs/operations/compact-company-quickstart.md | 9 ++-- docs/operations/deployment.md | 4 +- .../standalone-company-quickstart.md | 6 +-- docs/operations/standalone-pilot.md | 4 +- docs/system-user-guide.md | 4 +- frontend/e2e/support/auth.ts | 3 +- scripts/smoke_s3.py | 2 +- scripts/smoke_s4.py | 2 +- 25 files changed, 100 insertions(+), 74 deletions(-) create mode 100644 docs/adr/0055-unified-default-administrator-login.md diff --git a/.env.example b/.env.example index a87bbfd0..52e4a12e 100644 --- a/.env.example +++ b/.env.example @@ -16,7 +16,7 @@ FLOWTEST_WRITE_RATE_LIMIT_PER_MINUTE=120 FLOWTEST_RUNNER_CONTROL_RATE_LIMIT_PER_MINUTE=5000 FLOWTEST_SECRET_KEY=local-development-only-change-before-production-at-least-32-bytes FLOWTEST_BOOTSTRAP_ADMIN_EMAIL=admin@flowtest.dev -FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=FlowTest-Change-Me-123! +FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456 FLOWTEST_SECURE_COOKIES=false FLOWTEST_DATA_ENCRYPTION_KEY=Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI= # JSON 密钥引用映射；只通过 Secret Manager/.env 配置，不通过 API 提交密钥材料。 diff --git a/README.md b/README.md index ee765903..f8acd0f6 100644 --- a/README.md +++ b/README.md @@ -56,10 +56,10 @@ cd FlowTest ./deploy/compact/verify.sh ``` -首次启动会构建或下载镜像，并在 `deploy/compact/.env` 生成权限为 `0600` 的随机管理员密码和服务密钥； +首次启动会构建或下载镜像，并在 `deploy/compact/.env` 写入默认管理员密码和随机服务密钥； 该文件已被 Git 忽略，不得提交、上传或发到聊天/工单。启动完成后访问 ， -管理员可使用 `admin@flowtest.dev` 或账号别名 `admin` 登录。Windows 公司电脑请在 WSL2 中执行上述命令，并启用 Docker Desktop -的 WSL 集成。 +新安装默认使用 `admin/admin123456` 登录，无需首次改密。Windows 公司电脑请在 WSL2 中执行上述 +命令，并启用 Docker Desktop 的 WSL 集成。 详细的系统要求、首次登录、启停、内网开放、备份、升级及完全离线安装步骤见 [公司电脑 Compact 快速部署](docs/operations/compact-company-quickstart.md)。GitHub 源码压缩包不包含 @@ -96,10 +96,11 @@ docker compose up --build - gRPC/Reflection 目标服务：`localhost:50051` - MinIO Console： -登录账号字段同时接受管理员邮箱和 `admin` 别名；别名会解析到 -`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`。Full/Compact 的密码由 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 配置， -并按安装档位执行首次改密策略；Standalone 新包固定使用 `admin/admin` 且不强制首次改密。所有新建或 -主动修改的密码最低为 8 位；生产部署不得沿用示例值。 +任何环境中新安装的 Full、Compact 和 Standalone 均可使用 `admin/admin123456`，首次登录不强制修改密码。 +`admin` 别名解析到 `FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`（默认 `admin@flowtest.dev`）； +`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 可覆盖默认密码。已有数据库中的账号和密码不会因升级而重置， +已有 `.env` 也不会被启动脚本覆盖。所有新建或主动修改的密码最低为 8 位； +其他生产配置校验保持不变；如需修改默认密码，可自行在 `.env` 中覆盖。 S1 已提供 `/api/v1/auth`、`/api/v1/users`、`/api/v1/projects`、项目成员和任意层级目录接口。 Refresh Token 仅通过 HttpOnly Cookie 轮换，Access Token 有效期默认 15 分钟。 diff --git a/backend/app/core/config.py b/backend/app/core/config.py index b7e76621..4fb949cf 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -59,7 +59,7 @@ class Settings(BaseSettings): access_token_minutes: int = Field(default=15, ge=1, le=60) refresh_token_days: int = Field(default=7, ge=1, le=30) bootstrap_admin_email: str = "admin@flowtest.dev" - bootstrap_admin_password: str = "FlowTest-Change-Me-123!" # noqa: S105 + bootstrap_admin_password: str = "admin123456" # noqa: S105 secure_cookies: bool = False data_encryption_key: str = "Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI=" data_encryption_keyring: dict[str, str] = Field(default_factory=dict) @@ -281,7 +281,7 @@ def _validate_production(self) -> None: if self.runtime_profile is not RuntimeProfile.STANDALONE: unsafe = unsafe or self.s3_secret_key == "flowtest-local-secret" # noqa: S105 if unsafe or not self.secure_cookies: - raise ValueError("生产环境必须替换默认密钥、管理员密码并启用安全 Cookie") + raise ValueError("生产环境必须替换示例密钥、旧版管理员密码并启用安全 Cookie") if self.feature_oidc_enabled: oidc_urls = ( self.oidc_issuer_url, diff --git a/backend/app/services/auth.py b/backend/app/services/auth.py index abb3130e..2bb32b4b 100644 --- a/backend/app/services/auth.py +++ b/backend/app/services/auth.py @@ -238,7 +238,7 @@ async def bootstrap_administrator(session: AsyncSession) -> None: password_hash=password_service.hash(settings.bootstrap_admin_password), is_active=True, is_system_admin=True, - requires_password_change=settings.runtime_profile is not RuntimeProfile.STANDALONE, + requires_password_change=False, ) users.add(administrator) await session.commit() diff --git a/backend/tests/test_access_api.py b/backend/tests/test_access_api.py index 62131a9b..10b1df27 100644 --- a/backend/tests/test_access_api.py +++ b/backend/tests/test_access_api.py @@ -746,40 +746,35 @@ async def test_team_grants_and_direct_membership_precedence(client: AsyncClient) assert hidden.status_code == 404 +@pytest.mark.parametrize("runtime_profile", list(RuntimeProfile)) @pytest.mark.asyncio -async def test_bootstrap_administrator_is_idempotent() -> None: +async def test_bootstrap_administrator_uses_default_login_without_forced_change( + runtime_profile: RuntimeProfile, monkeypatch: pytest.MonkeyPatch +) -> None: + monkeypatch.setattr(settings, "runtime_profile", runtime_profile) + monkeypatch.setattr(settings, "bootstrap_admin_password", "admin123456") test_engine = create_async_engine("sqlite+aiosqlite://", poolclass=StaticPool) session_maker = async_sessionmaker(test_engine, expire_on_commit=False) async with test_engine.begin() as connection: await connection.run_sync(Base.metadata.create_all) async with session_maker() as session: - await bootstrap_administrator(session) await bootstrap_administrator(session) total = await session.scalar(select(func.count()).select_from(User)) administrator = await session.scalar(select(User)) - assert total == 1 - assert administrator is not None - assert administrator.is_system_admin - assert administrator.requires_password_change - await test_engine.dispose() - - -@pytest.mark.asyncio -async def test_standalone_bootstrap_uses_simple_password_without_forced_change( - monkeypatch: pytest.MonkeyPatch, -) -> None: - monkeypatch.setattr(settings, "runtime_profile", RuntimeProfile.STANDALONE) - monkeypatch.setattr(settings, "bootstrap_admin_password", "admin") - test_engine = create_async_engine("sqlite+aiosqlite://", poolclass=StaticPool) - session_maker = async_sessionmaker(test_engine, expire_on_commit=False) - async with test_engine.begin() as connection: - await connection.run_sync(Base.metadata.create_all) - async with session_maker() as session: + assert total == 1 + assert administrator is not None + assert administrator.is_system_admin + assert not administrator.requires_password_change + assert password_service.verify(administrator.password_hash, "admin123456") + + # Upgrading an existing database must not reset a user's password or flag. + administrator.password_hash = password_service.hash("existing-password-123!") + administrator.requires_password_change = True + await session.commit() await bootstrap_administrator(session) - administrator = await session.scalar(select(User)) - assert administrator is not None - assert not administrator.requires_password_change - assert password_service.verify(administrator.password_hash, "admin") + assert await session.scalar(select(func.count()).select_from(User)) == 1 + assert password_service.verify(administrator.password_hash, "existing-password-123!") + assert administrator.requires_password_change await test_engine.dispose() diff --git a/backend/tests/test_governance.py b/backend/tests/test_governance.py index 6d8404a4..d966b958 100644 --- a/backend/tests/test_governance.py +++ b/backend/tests/test_governance.py @@ -24,7 +24,7 @@ def test_fixed_role_capability_matrix() -> None: assert not ProjectRole.VIEWER.allows(ProjectCapability.EXECUTE) -def test_production_rejects_local_credentials_and_insecure_cookies() -> None: +def test_production_requires_secrets_and_secure_cookies() -> None: with pytest.raises(ValidationError, match="生产环境"): Settings(_env_file=None, environment="production") @@ -50,6 +50,16 @@ def test_production_rejects_local_credentials_and_insecure_cookies() -> None: secure_cookies=True, ) + configured_default_admin = Settings( + _env_file=None, + environment="production", + secret_key="production-signing-key-with-more-than-32-bytes", + data_encryption_key="eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg=", + s3_secret_key="production-object-storage-secret", + secure_cookies=True, + ) + assert configured_default_admin.bootstrap_admin_password == "admin123456" + def test_data_encryption_keyring_validates_references_and_key_material() -> None: encoded_key = urlsafe_b64encode(b"k" * 32).decode() diff --git a/compose.yaml b/compose.yaml index 578305ad..dadce81a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -3,7 +3,7 @@ x-flowtest-environment: &flowtest-environment FLOWTEST_DEBUG: "true" FLOWTEST_SECRET_KEY: ${FLOWTEST_SECRET_KEY:-local-development-only-change-before-production} FLOWTEST_BOOTSTRAP_ADMIN_EMAIL: ${FLOWTEST_BOOTSTRAP_ADMIN_EMAIL:-admin@flowtest.dev} - FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: ${FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD:-FlowTest-Change-Me-123!} + FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: ${FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD:-admin123456} FLOWTEST_SECURE_COOKIES: "false" FLOWTEST_DATA_ENCRYPTION_KEY: ${FLOWTEST_DATA_ENCRYPTION_KEY:-Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI=} FLOWTEST_DATA_ENCRYPTION_KEYRING: '${FLOWTEST_DATA_ENCRYPTION_KEYRING:-{}}' diff --git a/deploy/compact/README.md b/deploy/compact/README.md index 8bb91072..f42e3e37 100644 --- a/deploy/compact/README.md +++ b/deploy/compact/README.md @@ -31,12 +31,13 @@ cd FlowTest ./deploy/compact/verify.sh ``` -脚本首次运行会生成 `deploy/compact/.env`，权限为 `0600`，其中包含随机管理员密码和随机服务密钥； -已有文件绝不会被覆盖。启动完成后访问 ，管理员邮箱默认为 -`admin@flowtest.dev`。登录页面的账号字段同时接受邮箱和 `admin` 别名；`admin` 会解析到配置的 -`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`。密码仍以本机 `.env` 中的 -`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 为准，Compact 首次登录后需要修改密码。不要复制密码到聊天、工单 -或部署日志。登录后如果账号没有项目，质量总览和项目管理页会显示“创建第一个项目”入口。 +脚本首次运行会生成权限为 `0600` 的 `deploy/compact/.env`，默认管理员账号和密码为 +`admin/admin123456`，其余服务密钥随机生成；已有文件绝不会被覆盖。启动后访问 +，首次登录不强制改密。`admin` 别名解析到配置的 +`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`（默认 `admin@flowtest.dev`）；可在启动前修改 `.env` 中的 +`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD`。已有数据库账号不会被启动脚本重置。不要把 `.env` 上传到 +聊天、工单或部署日志。若账号没有项目，质量总览和项目管理页会 +显示“创建第一个项目”入口。 源码构建使用独立 `compose.build.yaml`；当同目录存在 `images.env` 时，`start.sh` 会自动改为 不构建、不拉取的镜像部署模式。 diff --git a/deploy/compact/generate_env.sh b/deploy/compact/generate_env.sh index ae0c09b2..6fc3febe 100755 --- a/deploy/compact/generate_env.sh +++ b/deploy/compact/generate_env.sh @@ -15,7 +15,6 @@ fi umask 077 secret_key="$(openssl rand -hex 32)" -admin_password="$(openssl rand -hex 16)" data_encryption_key="$(openssl rand -base64 32 | tr -d '\n')" postgres_password="$(openssl rand -hex 24)" minio_password="$(openssl rand -hex 24)" @@ -29,7 +28,7 @@ FLOWTEST_S3_PORT=9000 FLOWTEST_PUBLIC_ORIGIN=http://localhost:3000 FLOWTEST_SECURE_COOKIES=false FLOWTEST_BOOTSTRAP_ADMIN_EMAIL=admin@flowtest.dev -FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=${admin_password} +FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456 FLOWTEST_SECRET_KEY=${secret_key} FLOWTEST_DATA_ENCRYPTION_KEY=${data_encryption_key} FLOWTEST_DATA_ENCRYPTION_KEYRING={} diff --git a/deploy/standalone/.env.example b/deploy/standalone/.env.example index 3fd9a572..47634d06 100644 --- a/deploy/standalone/.env.example +++ b/deploy/standalone/.env.example @@ -26,8 +26,8 @@ FLOWTEST_FEATURE_PERFORMANCE_LAB_ENABLED=false FLOWTEST_FEATURE_ENVIRONMENT_LAB_ENABLED=false FLOWTEST_FEATURE_RUNNER_FABRIC_ENABLED=false -# start.ps1 首次运行会自动生成密钥；Standalone 初始账号为 admin，密码为 admin。 +# start.ps1 首次运行会自动生成密钥；Standalone 初始账号为 admin，密码为 admin123456。 FLOWTEST_SECRET_KEY=replace-on-first-start -FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin +FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456 FLOWTEST_DATA_ENCRYPTION_KEY=replace-on-first-start FLOWTEST_DATA_ENCRYPTION_KEYRING={} diff --git a/deploy/standalone/README.md b/deploy/standalone/README.md index 7b0e1cdd..a507bc37 100644 --- a/deploy/standalone/README.md +++ b/deploy/standalone/README.md @@ -68,9 +68,8 @@ Set-ExecutionPolicy -Scope Process Bypass 或联网。首次运行如果尚未创建 `.env`，检查会给出提示，随后由 `start.ps1` 生成随机服务密钥。 首次启动会在包根目录创建 `.env`、`data\`、`logs\` 和 `.flowtest\`。Standalone 本地初始账号固定为 -`admin`，初始密码固定为 `admin`，不会强制首次改密；新建用户和主动修改密码的最低长度为 8 位。 -该简单凭据只适用于默认的本机回环试用，若使用 `-BindHost` 对公司网段开放，应在验证完成后立即修改 -管理员密码。访问 。 +`admin`，初始密码固定为 `admin123456`，不会强制首次改密；新建用户和主动修改密码的最低长度为 8 位。 +该默认凭据在各环境中一致，可按需要自行修改。访问 。 如果需要受控内网访问，使用明确的监听地址启动，并先由 IT 配置 Windows 防火墙： ```powershell diff --git a/deploy/standalone/preflight.ps1 b/deploy/standalone/preflight.ps1 index 2f49de4d..b4c1bc24 100644 --- a/deploy/standalone/preflight.ps1 +++ b/deploy/standalone/preflight.ps1 @@ -118,7 +118,7 @@ if (Test-Path -LiteralPath $envFile) { } } } else { - Add-PreflightWarning("尚未找到 .env；首次 start.ps1 会生成随机密钥，并使用 Standalone 初始账号 admin/admin") + Add-PreflightWarning("尚未找到 .env；首次 start.ps1 会生成随机密钥，并使用 Standalone 初始账号 admin/admin123456") } $drive = New-Object -TypeName System.IO.DriveInfo -ArgumentList ([System.IO.Path]::GetPathRoot($Root)) diff --git a/deploy/standalone/start.ps1 b/deploy/standalone/start.ps1 index 60ee0041..5f876e38 100644 --- a/deploy/standalone/start.ps1 +++ b/deploy/standalone/start.ps1 @@ -26,16 +26,12 @@ function Ensure-EnvFile { "FLOWTEST_SECRET_KEY=replace-on-first-start", "FLOWTEST_SECRET_KEY=$(New-Secret 32)" ) - $content = $content.Replace( - "FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=replace-on-first-start", - "FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin" - ) $content = $content.Replace( "FLOWTEST_DATA_ENCRYPTION_KEY=replace-on-first-start", "FLOWTEST_DATA_ENCRYPTION_KEY=$(New-Secret 32)" ) Set-Content -Path $EnvFile -Value $content -Encoding UTF8 -NoNewline - Write-Host "已创建 .env；Standalone 初始账号为 admin，密码为 admin。" + Write-Host "已创建 .env；Standalone 初始账号为 admin，密码为 admin123456。" } function Find-Python { diff --git a/deploy/upgrade/compose.yaml b/deploy/upgrade/compose.yaml index 6ce6ce1a..6ce6e97a 100644 --- a/deploy/upgrade/compose.yaml +++ b/deploy/upgrade/compose.yaml @@ -3,7 +3,7 @@ x-flowtest-environment: &flowtest-environment FLOWTEST_DEBUG: "true" FLOWTEST_SECRET_KEY: ${FLOWTEST_UPGRADE_SECRET_KEY:-upgrade-rehearsal-only-change-me-now} FLOWTEST_BOOTSTRAP_ADMIN_EMAIL: admin@flowtest.dev - FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: FlowTest-Change-Me-123! + FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: admin123456 FLOWTEST_SECURE_COOKIES: "false" FLOWTEST_DATA_ENCRYPTION_KEY: ${FLOWTEST_UPGRADE_DATA_ENCRYPTION_KEY:-Zmxvd3Rlc3QtdXBncmFkZS1yZWhlYXJzYWwta2V5LTM=} FLOWTEST_DATA_ENCRYPTION_KEYRING: '${FLOWTEST_UPGRADE_DATA_ENCRYPTION_KEYRING:-{}}' diff --git a/docs/adr/0026-explicit-runtime-profiles-and-compact-deployment.md b/docs/adr/0026-explicit-runtime-profiles-and-compact-deployment.md index 09f143fd..4ebd3a04 100644 --- a/docs/adr/0026-explicit-runtime-profiles-and-compact-deployment.md +++ b/docs/adr/0026-explicit-runtime-profiles-and-compact-deployment.md @@ -3,6 +3,9 @@ 状态：Accepted 日期：2026-08-19 +第 7 项的随机管理员密码决策已由 [ADR 0055](0055-unified-default-administrator-login.md) 替代； +其他部署拓扑和密钥生成规则不变。 + ## 背景 Full Compose 为容量、安全和多执行面验收同时启动 PostgreSQL、Redis、MinIO、Redpanda、多类 Worker、 diff --git a/docs/adr/0055-unified-default-administrator-login.md b/docs/adr/0055-unified-default-administrator-login.md new file mode 100644 index 00000000..d28d0b51 --- /dev/null +++ b/docs/adr/0055-unified-default-administrator-login.md @@ -0,0 +1,21 @@ +# ADR 0055：统一默认管理员登录 + +状态：Accepted +日期：2026-09-24 + +## 决策 + +Full、Compact 和 Standalone 新安装统一使用登录别名 `admin` 和初始密码 +`admin123456`。别名继续映射到 `FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`（默认 +`admin@flowtest.dev`）；通过 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 可以在部署前覆盖密码。 +新建的 bootstrap 管理员不设置首次改密标记，其他用户的首次改密规则不变。 + +此决策替代 [ADR 0026](0026-explicit-runtime-profiles-and-compact-deployment.md) 第 7 项中的 +Compact 随机管理员密码。Compact 的 JWT、数据加密、数据库和对象存储密钥继续随机生成； +配置生成器拒绝覆盖已有 `.env`。启动 bootstrap 对已有用户保持幂等，不重置密码或改密标记。 +此默认账号密码适用于所有运行环境；其他生产配置校验保持不变。 + +## 影响 + +只影响新建部署和新建数据库中的 bootstrap 管理员。已有部署维持原账号密码； +管理员如需统一旧环境凭据，应通过正常改密流程分别处理。 diff --git a/docs/adr/README.md b/docs/adr/README.md index cf0868a1..bda01c1f 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -56,3 +56,4 @@ 52. MCP 零接入连接、身份与 Scope 契约 53. MCP 组织级项目初始化与测试目标边界 54. S62 分析准备、Test Plan 建议与 Preview 控制 +55. Full/Compact/Standalone 统一默认管理员登录 diff --git a/docs/operations/compact-company-quickstart.md b/docs/operations/compact-company-quickstart.md index 5b8662f0..c6bfb12d 100644 --- a/docs/operations/compact-company-quickstart.md +++ b/docs/operations/compact-company-quickstart.md @@ -51,12 +51,13 @@ cd FlowTest `start.sh` 会执行安装前检查、首次构建、数据库迁移和 Readiness 验证。首次运行时间取决于公司网络和 Docker 镜像缓存。成功标准是 `verify.sh` 输出 6 个服务运行中，数据库、Redis 和对象存储均就绪。 -首次启动会创建 `deploy/compact/.env`，权限为 `0600`，并写入随机管理员密码、JWT 密钥、 +首次启动会创建 `deploy/compact/.env`，权限为 `0600`，并写入默认管理员密码、随机 JWT 密钥、 AES-256-GCM 数据加密密钥、数据库和对象存储凭据。脚本拒绝覆盖已有 `.env`；该文件已被 Git 忽略， 但仍应限制为部署管理员可读并纳入公司 Secret 托管，不得提交 Git、上传网盘或粘贴到工单。 -浏览器访问 ，使用管理员邮箱 `admin@flowtest.dev`（或账号别名 `admin`）和本机 -`.env` 中的 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 登录，随后立即修改密码。若登录账号没有项目，进入 +浏览器访问 ，新安装使用 `admin/admin123456` 登录，无需首次改密。 +已有 `.env` 和数据库账号不会因升级被覆盖；可在 `.env` 中修改 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD`。 +若登录账号没有项目，进入 质量总览即可看到“创建第一个项目”按钮；创建后会自动切换到新项目。 ## 日常启停和检查 @@ -137,7 +138,7 @@ cd flowtest-compact-*/ - `verify.sh` 通过，且恰好 6 个服务处于运行状态。 - 可登录，`/api/v1/ready` 返回正常。 -- 已修改初始管理员密码，`.env` 仅部署管理员可读并已独立托管。 +- `.env` 仅部署管理员可读并已独立托管；管理员密码可按需要自行修改。 - 未向 Git 提交 `.env`、`images.env`、离线镜像包、诊断目录或业务备份。 - 需要跨主机访问时已启用公司 TLS、受控内网地址和 Secure Cookie。 - 首次录入业务数据前已验证备份目录、恢复责任人与升级维护窗口。 diff --git a/docs/operations/deployment.md b/docs/operations/deployment.md index 6a5ca180..eee4e2f5 100644 --- a/docs/operations/deployment.md +++ b/docs/operations/deployment.md @@ -21,7 +21,7 @@ 1. 复制 `.env.example` 为 `.env`。 2. 将 `FLOWTEST_ENVIRONMENT` 设置为 `production`。 -3. 替换 JWT 签名密钥、管理员密码、AES-256-GCM 密钥、PostgreSQL、MinIO 凭据并设置 +3. 替换 JWT 签名密钥、AES-256-GCM 密钥、PostgreSQL、MinIO 凭据并设置 `FLOWTEST_SECURE_COOKIES=true`。启用 OIDC、Vault、Grafana 或 PITR 时，同时替换相应 Client Secret、Vault Token、Grafana 密码和 WAL-G 加密密钥。应用会拒绝核心服务携带示例凭据的生产配置。 启用 AI 时还必须配置 HTTPS OpenAI-compatible 网关、模型和运行时 API Key；AI 默认关闭。 @@ -33,7 +33,7 @@ 4. 运行 `docker compose config --quiet`，确认插值结果中没有空凭据。 5. 运行 `docker compose up -d --build --wait`。 6. 验证 `/api/v1/live`、`/api/v1/ready`、`/api/v1/metrics` 和 Web 首页。 -7. 使用初始管理员登录并立即修改密码。 +7. 新安装默认使用 `admin/admin123456` 登录，无需首次改密。 ## TLS 接入 diff --git a/docs/operations/standalone-company-quickstart.md b/docs/operations/standalone-company-quickstart.md index c1bc0f05..dd00967b 100644 --- a/docs/operations/standalone-company-quickstart.md +++ b/docs/operations/standalone-company-quickstart.md @@ -33,9 +33,9 @@ cd C:\flowtest-standalone 端口占用；失败时先按 JSON 输出的 `errors` 修复。它不会打印 `.env` 中的密钥，也不需要 Docker、WSL2 或联网。 -浏览器打开 `http://127.0.0.1:8000`，使用账号 `admin`、密码 `admin` 登录。Standalone 不强制首次改密； -新建用户和主动修改密码的最低长度为 8 位。`admin/admin` 只适用于默认本机回环试用，若按公司要求开放 -内网访问，应在验证完成后立即修改管理员密码。安装人员不要把 `.env` 上传 GitHub、工单或聊天工具。 +浏览器打开 `http://127.0.0.1:8000`，使用账号 `admin`、密码 `admin123456` 登录。Standalone 不强制首次改密； +新建用户和主动修改密码的最低长度为 8 位。默认凭据在各环境中一致，可按需要自行修改。 +安装人员不要把 `.env` 上传 GitHub、工单或聊天工具。 ### 项目出站策略 diff --git a/docs/operations/standalone-pilot.md b/docs/operations/standalone-pilot.md index 3ac06b3f..b444f6bb 100644 --- a/docs/operations/standalone-pilot.md +++ b/docs/operations/standalone-pilot.md @@ -25,8 +25,8 @@ cd C:\flowtest-standalone .\deploy\standalone\preflight.ps1 ``` -检查输出必须为 `status=passed`。首次启动由 `start.ps1` 生成 `.env`；使用初始账号 `admin`、密码 `admin` -登录即可，Standalone 不强制首次改密（若开放内网访问，验证后立即修改）。记录 +检查输出必须为 `status=passed`。首次启动由 `start.ps1` 生成 `.env`；使用初始账号 `admin`、密码 `admin123456` +登录即可，Standalone 不强制首次改密。记录 `/api/v1/runtime-profile` 的 `profile=standalone`、 `worker_topology=in_process`，并确认 Readiness 不包含 Redis。 diff --git a/docs/system-user-guide.md b/docs/system-user-guide.md index 1e1a1bb4..4b0dca31 100644 --- a/docs/system-user-guide.md +++ b/docs/system-user-guide.md @@ -54,8 +54,8 @@ ### 2.2 登录 -- Full/Compact：使用 `admin@flowtest.dev` 或别名 `admin`，密码读取部署目录 `.env` 中的 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD`。首次登录后按页面要求修改密码。 -- Standalone 默认包：使用 `admin/admin`。如果不再仅限本机回环访问，应立即修改密码。 +- Full/Compact/Standalone 新安装：默认使用 `admin/admin123456`，首次登录不强制改密。管理员邮箱默认为 `admin@flowtest.dev`，可在 `.env` 中覆盖；已有数据库账号密码不会被升级重置。 +- 此默认账号和密码适用于所有环境；可通过 `.env` 自行覆盖。其他生产配置规则不变。 - 企业环境可由管理员配置 OIDC；OIDC 首次登录用户不会自动获得项目访问权限，仍需加入组织和项目。 ### 2.3 第一次完成可运行闭环 diff --git a/frontend/e2e/support/auth.ts b/frontend/e2e/support/auth.ts index 492c94d2..6ca31ccd 100644 --- a/frontend/e2e/support/auth.ts +++ b/frontend/e2e/support/auth.ts @@ -2,8 +2,7 @@ import { expect, type Page, type Response } from '@playwright/test' export const administratorEmail = process.env.FLOWTEST_E2E_ADMIN_EMAIL ?? 'admin@flowtest.dev' export const activePassword = process.env.FLOWTEST_E2E_ACTIVE_PASSWORD ?? 'FlowTest-E2E-Admin-123!' -export const bootstrapPassword = - process.env.FLOWTEST_E2E_BOOTSTRAP_PASSWORD ?? 'FlowTest-Change-Me-123!' +export const bootstrapPassword = process.env.FLOWTEST_E2E_BOOTSTRAP_PASSWORD ?? 'admin123456' export const authenticationStatePath = '.playwright/.auth/administrator.json' export async function authenticate(page: Page): Promise { diff --git a/scripts/smoke_s3.py b/scripts/smoke_s3.py index c666247f..e6b2939b 100755 --- a/scripts/smoke_s3.py +++ b/scripts/smoke_s3.py @@ -26,7 +26,7 @@ def from_environment(cls) -> SmokeConfig: return cls( api_url=os.getenv("FLOWTEST_SMOKE_API_URL", "http://localhost:8000/api/v1"), email=os.getenv("FLOWTEST_SMOKE_ADMIN_EMAIL", "admin@flowtest.dev"), - password=os.getenv("FLOWTEST_SMOKE_ADMIN_PASSWORD", "FlowTest-Change-Me-123!"), + password=os.getenv("FLOWTEST_SMOKE_ADMIN_PASSWORD", "admin123456"), target_url=os.getenv("FLOWTEST_SMOKE_TARGET_URL", "http://mock-target:8080"), ) diff --git a/scripts/smoke_s4.py b/scripts/smoke_s4.py index d66110cc..2c5a2540 100755 --- a/scripts/smoke_s4.py +++ b/scripts/smoke_s4.py @@ -27,7 +27,7 @@ def from_environment(cls) -> SmokeConfig: return cls( api_url=os.getenv("FLOWTEST_SMOKE_API_URL", "http://localhost:8000/api/v1"), email=os.getenv("FLOWTEST_SMOKE_ADMIN_EMAIL", "admin@flowtest.dev"), - password=os.getenv("FLOWTEST_SMOKE_ADMIN_PASSWORD", "FlowTest-Change-Me-123!"), + password=os.getenv("FLOWTEST_SMOKE_ADMIN_PASSWORD", "admin123456"), target_url=os.getenv("FLOWTEST_SMOKE_TARGET_URL", "http://mock-target:8080"), ) From 23944d921f5be28039684a6c2ed8bbb680ee2fda Mon Sep 17 00:00:00 2001 From: tianM <46552064+a3384379@users.noreply.github.com> Date: Thu, 24 Sep 2026 22:20:24 +0800 Subject: [PATCH 2/3] Restore accessible MinIO image for Compose deployments --- compose.yaml | 9 +++++++-- deploy/compact/compose.yaml | 9 +++++++-- deploy/compact/export_offline_bundle.sh | 2 +- deploy/compact/images.env.example | 2 +- deploy/compact/publish_private_registry.sh | 2 +- deploy/compatibility/compose.yaml | 9 +++++++-- deploy/upgrade/compose.yaml | 9 +++++++-- 7 files changed, 31 insertions(+), 11 deletions(-) diff --git a/compose.yaml b/compose.yaml index dadce81a..c30dc9d5 100644 --- a/compose.yaml +++ b/compose.yaml @@ -221,7 +221,8 @@ services: memory: 768M minio: - image: quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z + image: cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1 + user: "0:0" command: server /data --console-address ":9001" environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER:-flowtest} @@ -232,7 +233,11 @@ services: volumes: - minio_data:/data healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] + test: + - CMD + - bash + - -ec + - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]' interval: 5s timeout: 5s retries: 20 diff --git a/deploy/compact/compose.yaml b/deploy/compact/compose.yaml index 83bbf0b9..85269d4a 100644 --- a/deploy/compact/compose.yaml +++ b/deploy/compact/compose.yaml @@ -92,7 +92,8 @@ services: memory: 192M minio: - image: ${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z} + image: ${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1} + user: "0:0" restart: unless-stopped command: server /data environment: @@ -104,7 +105,11 @@ services: volumes: - minio_data:/data healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] + test: + - CMD + - bash + - -ec + - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]' interval: 5s timeout: 5s retries: 20 diff --git a/deploy/compact/export_offline_bundle.sh b/deploy/compact/export_offline_bundle.sh index c5d7ea96..f76d0649 100755 --- a/deploy/compact/export_offline_bundle.sh +++ b/deploy/compact/export_offline_bundle.sh @@ -40,7 +40,7 @@ backend_source="${FLOWTEST_BACKEND_IMAGE:-flowtest/backend:local}" frontend_source="${FLOWTEST_FRONTEND_IMAGE:-flowtest/frontend:local}" postgres_source="${FLOWTEST_POSTGRES_IMAGE:-postgres:17.6-alpine}" redis_source="${FLOWTEST_REDIS_IMAGE:-redis:8.2.1-alpine}" -minio_source="${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}" +minio_source="${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}" for image_reference in \ "${backend_source}" \ diff --git a/deploy/compact/images.env.example b/deploy/compact/images.env.example index 54cc3e92..6b5e983f 100644 --- a/deploy/compact/images.env.example +++ b/deploy/compact/images.env.example @@ -4,4 +4,4 @@ FLOWTEST_BACKEND_IMAGE=flowtest/backend:local FLOWTEST_FRONTEND_IMAGE=flowtest/frontend:local FLOWTEST_POSTGRES_IMAGE=postgres:17.6-alpine FLOWTEST_REDIS_IMAGE=redis:8.2.1-alpine -FLOWTEST_MINIO_IMAGE=quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z +FLOWTEST_MINIO_IMAGE=cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1 diff --git a/deploy/compact/publish_private_registry.sh b/deploy/compact/publish_private_registry.sh index 3e0463a0..569812e4 100755 --- a/deploy/compact/publish_private_registry.sh +++ b/deploy/compact/publish_private_registry.sh @@ -90,7 +90,7 @@ publish_image FLOWTEST_POSTGRES_IMAGE postgres \ publish_image FLOWTEST_REDIS_IMAGE redis \ "${FLOWTEST_REDIS_IMAGE:-redis:8.2.1-alpine}" publish_image FLOWTEST_MINIO_IMAGE minio \ - "${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}" + "${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}" chmod 0644 "${temporary_output}" mv "${temporary_output}" "${output_environment}" diff --git a/deploy/compatibility/compose.yaml b/deploy/compatibility/compose.yaml index 40179fed..3fb36531 100644 --- a/deploy/compatibility/compose.yaml +++ b/deploy/compatibility/compose.yaml @@ -70,7 +70,8 @@ services: retries: 20 minio: - image: ${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z} + image: ${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1} + user: "0:0" command: server /data environment: MINIO_ROOT_USER: ${MINIO_ROOT_USER:-flowtest} @@ -79,7 +80,11 @@ services: volumes: - minio_data:/data healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] + test: + - CMD + - bash + - -ec + - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]' interval: 5s timeout: 5s retries: 20 diff --git a/deploy/upgrade/compose.yaml b/deploy/upgrade/compose.yaml index 6ce6e97a..37dcd6d4 100644 --- a/deploy/upgrade/compose.yaml +++ b/deploy/upgrade/compose.yaml @@ -110,7 +110,8 @@ services: retries: 30 minio: - image: quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z + image: cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1 + user: "0:0" command: server /data environment: MINIO_ROOT_USER: flowtest @@ -118,7 +119,11 @@ services: volumes: - minio_data:/data healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"] + test: + - CMD + - bash + - -ec + - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]' interval: 3s timeout: 5s retries: 30 From 2ef2be5f11d5efd6df9026db9458f031387cec22 Mon Sep 17 00:00:00 2001 From: tianM <46552064+a3384379@users.noreply.github.com> Date: Thu, 24 Sep 2026 22:59:19 +0800 Subject: [PATCH 3/3] Repair upgrade, restore, and fixture image gates --- .github/workflows/compose-ci.yml | 2 +- .github/workflows/security-ci.yml | 4 ++-- backend/tests/test_environment_lab.py | 2 +- deploy/upgrade/compose.yaml | 3 ++- frontend/src/pages/EnvironmentLabPage.test.tsx | 2 +- frontend/src/pages/EnvironmentLabPage.tsx | 2 +- scripts/smoke_s26.py | 2 +- scripts/verify_restore.sh | 7 ++++--- scripts/verify_v2_v3_upgrade.sh | 1 + 9 files changed, 14 insertions(+), 11 deletions(-) diff --git a/.github/workflows/compose-ci.yml b/.github/workflows/compose-ci.yml index a446d3c2..b3592259 100644 --- a/.github/workflows/compose-ci.yml +++ b/.github/workflows/compose-ci.yml @@ -285,7 +285,7 @@ jobs: FLOWTEST_FEATURE_EVENT_PROTOCOLS_ENABLED: "true" FLOWTEST_FEATURE_PERFORMANCE_LAB_ENABLED: "true" FLOWTEST_FEATURE_ENVIRONMENT_LAB_ENABLED: "true" - FLOWTEST_ENVIRONMENT_IMAGE_ALLOWLIST: '["docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce"]' + FLOWTEST_ENVIRONMENT_IMAGE_ALLOWLIST: '["docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d"]' FLOWTEST_AI_BASE_URL: http://mock-target:8080/v1 FLOWTEST_AI_MODEL: flowtest-compose-model FLOWTEST_AI_API_KEY: flowtest-mock-ai-key diff --git a/.github/workflows/security-ci.yml b/.github/workflows/security-ci.yml index 01891e5e..b5619e05 100644 --- a/.github/workflows/security-ci.yml +++ b/.github/workflows/security-ci.yml @@ -67,8 +67,8 @@ jobs: docker build --target runner-runtime -t flowtest-runner:ci backend docker build -t flowtest-frontend:ci frontend docker build -t flowtest-mock-target:ci mock-target - docker pull docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce - docker tag docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce flowtest-environment-fixture:ci + docker pull docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d + docker tag docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d flowtest-environment-fixture:ci - name: Scan backend image uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 with: diff --git a/backend/tests/test_environment_lab.py b/backend/tests/test_environment_lab.py index bc1d0d79..95106fa3 100644 --- a/backend/tests/test_environment_lab.py +++ b/backend/tests/test_environment_lab.py @@ -43,7 +43,7 @@ USER_PASSWORD = "environment-user-password-123!" FIXTURE_IMAGE = ( "docker.io/nginxinc/nginx-unprivileged@sha256:" - "442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce" + "123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d" ) diff --git a/deploy/upgrade/compose.yaml b/deploy/upgrade/compose.yaml index 37dcd6d4..a91d2794 100644 --- a/deploy/upgrade/compose.yaml +++ b/deploy/upgrade/compose.yaml @@ -3,7 +3,8 @@ x-flowtest-environment: &flowtest-environment FLOWTEST_DEBUG: "true" FLOWTEST_SECRET_KEY: ${FLOWTEST_UPGRADE_SECRET_KEY:-upgrade-rehearsal-only-change-me-now} FLOWTEST_BOOTSTRAP_ADMIN_EMAIL: admin@flowtest.dev - FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: admin123456 + # This rehearsal preserves the V2 account and its historical 12+ character password. + FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: FlowTest-Change-Me-123! FLOWTEST_SECURE_COOKIES: "false" FLOWTEST_DATA_ENCRYPTION_KEY: ${FLOWTEST_UPGRADE_DATA_ENCRYPTION_KEY:-Zmxvd3Rlc3QtdXBncmFkZS1yZWhlYXJzYWwta2V5LTM=} FLOWTEST_DATA_ENCRYPTION_KEYRING: '${FLOWTEST_UPGRADE_DATA_ENCRYPTION_KEYRING:-{}}' diff --git a/frontend/src/pages/EnvironmentLabPage.test.tsx b/frontend/src/pages/EnvironmentLabPage.test.tsx index 3813224c..c61fa93c 100644 --- a/frontend/src/pages/EnvironmentLabPage.test.tsx +++ b/frontend/src/pages/EnvironmentLabPage.test.tsx @@ -16,7 +16,7 @@ import { server } from '../test/server' import EnvironmentLabPage from './EnvironmentLabPage' const fixtureImage = - 'docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce' + 'docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d' const template: EnvironmentTemplateVersion = { id: '00000000-0000-4000-8000-000000001001', diff --git a/frontend/src/pages/EnvironmentLabPage.tsx b/frontend/src/pages/EnvironmentLabPage.tsx index b4666c04..b42f30cf 100644 --- a/frontend/src/pages/EnvironmentLabPage.tsx +++ b/frontend/src/pages/EnvironmentLabPage.tsx @@ -549,7 +549,7 @@ function TemplateDialog({ } const fixtureImage = - 'docker.io/nginxinc/nginx-unprivileged@sha256:442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce' + 'docker.io/nginxinc/nginx-unprivileged@sha256:123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d' function templateFormValues(base?: EnvironmentTemplateVersion): TemplateForm { return base ? versionFormValues(base) : defaultTemplateFormValues diff --git a/scripts/smoke_s26.py b/scripts/smoke_s26.py index 772d4636..d60e0b52 100755 --- a/scripts/smoke_s26.py +++ b/scripts/smoke_s26.py @@ -15,7 +15,7 @@ FIXTURE_IMAGE = ( "docker.io/nginxinc/nginx-unprivileged@sha256:" - "442753882674b49ae2c1de83ed67896131c0777f56df5005e356e62bc3f7e7ce" + "123fb7283ffb4788e260d4e980005a978995fefedcdbb04d268077a19b84576d" ) diff --git a/scripts/verify_restore.sh b/scripts/verify_restore.sh index 5f5360c7..80498864 100755 --- a/scripts/verify_restore.sh +++ b/scripts/verify_restore.sh @@ -36,7 +36,8 @@ wait_for_postgres() { wait_for_minio() { local _attempt for _attempt in $(seq 1 60); do - if docker exec "${minio_container}" curl -fsS http://localhost:9000/minio/health/live \ + if docker exec "${minio_container}" bash -ec \ + 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$status" == *" 200 "* ]]' \ >/dev/null 2>&1; then return 0 fi @@ -61,10 +62,10 @@ docker run -d --name "${postgres_container}" --network "${network}" \ -e POSTGRES_USER=flowtest -e POSTGRES_PASSWORD=restore-verification \ -e POSTGRES_DB=flowtest -v "${postgres_volume}:/var/lib/postgresql/data" \ postgres:17.6-alpine >/dev/null -docker run -d --name "${minio_container}" --network "${network}" \ +docker run -d --name "${minio_container}" --network "${network}" --user 0:0 \ -e MINIO_ROOT_USER=flowtest -e MINIO_ROOT_PASSWORD=restore-verification \ -v "${minio_volume}:/data" \ - quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z server /data >/dev/null + cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1 server /data >/dev/null wait_for_postgres wait_for_minio diff --git a/scripts/verify_v2_v3_upgrade.sh b/scripts/verify_v2_v3_upgrade.sh index d75f7354..0b870943 100755 --- a/scripts/verify_v2_v3_upgrade.sh +++ b/scripts/verify_v2_v3_upgrade.sh @@ -81,6 +81,7 @@ verify_phase() { --volume "${temporary_root}:/state:rw" \ --workdir /tmp/scripts \ --env "FLOWTEST_SMOKE_API_URL=http://${api_service}:8000/api/v1" \ + --env "FLOWTEST_SMOKE_ADMIN_PASSWORD=FlowTest-Change-Me-123!" \ current-api python verify_v2_v3_data.py verify \ --state /state/state.json --phase "${phase}" storage_transfer verify