Unify admin login and restore Compose MinIO image

.env.example

@@ -16,7 +16,7 @@ FLOWTEST_WRITE_RATE_LIMIT_PER_MINUTE=120
 FLOWTEST_RUNNER_CONTROL_RATE_LIMIT_PER_MINUTE=5000
 FLOWTEST_SECRET_KEY=local-development-only-change-before-production-at-least-32-bytes
 FLOWTEST_BOOTSTRAP_ADMIN_EMAIL=admin@flowtest.dev
-FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=FlowTest-Change-Me-123!
+FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456
 FLOWTEST_SECURE_COOKIES=false
 FLOWTEST_DATA_ENCRYPTION_KEY=Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI=
 # JSON 密钥引用映射；只通过 Secret Manager/.env 配置，不通过 API 提交密钥材料。

README.md

@@ -56,10 +56,10 @@ cd FlowTest
 ./deploy/compact/verify.sh
 ```
 
-首次启动会构建或下载镜像，并在 `deploy/compact/.env` 生成权限为 `0600` 的随机管理员密码和服务密钥；
+首次启动会构建或下载镜像，并在 `deploy/compact/.env` 写入默认管理员密码和随机服务密钥；
 该文件已被 Git 忽略，不得提交、上传或发到聊天/工单。启动完成后访问 <http://localhost:3000>，
-管理员可使用 `admin@flowtest.dev` 或账号别名 `admin` 登录。Windows 公司电脑请在 WSL2 中执行上述命令，并启用 Docker Desktop
-的 WSL 集成。
+新安装默认使用 `admin/admin123456` 登录，无需首次改密。Windows 公司电脑请在 WSL2 中执行上述
+命令，并启用 Docker Desktop 的 WSL 集成。
 
 详细的系统要求、首次登录、启停、内网开放、备份、升级及完全离线安装步骤见
 [公司电脑 Compact 快速部署](docs/operations/compact-company-quickstart.md)。GitHub 源码压缩包不包含
@@ -96,10 +96,11 @@ docker compose up --build
 - gRPC/Reflection 目标服务：`localhost:50051`
 - MinIO Console：<http://localhost:9001>
 
-登录账号字段同时接受管理员邮箱和 `admin` 别名；别名会解析到
-`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`。Full/Compact 的密码由 `FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 配置，
-并按安装档位执行首次改密策略；Standalone 新包固定使用 `admin/admin` 且不强制首次改密。所有新建或
-主动修改的密码最低为 8 位；生产部署不得沿用示例值。
+任何环境中新安装的 Full、Compact 和 Standalone 均可使用 `admin/admin123456`，首次登录不强制修改密码。
+`admin` 别名解析到 `FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`（默认 `admin@flowtest.dev`）；
+`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 可覆盖默认密码。已有数据库中的账号和密码不会因升级而重置，
+已有 `.env` 也不会被启动脚本覆盖。所有新建或主动修改的密码最低为 8 位；
+其他生产配置校验保持不变；如需修改默认密码，可自行在 `.env` 中覆盖。
 
 S1 已提供 `/api/v1/auth`、`/api/v1/users`、`/api/v1/projects`、项目成员和任意层级目录接口。
 Refresh Token 仅通过 HttpOnly Cookie 轮换，Access Token 有效期默认 15 分钟。

backend/app/core/config.py

@@ -59,7 +59,7 @@ class Settings(BaseSettings):
     access_token_minutes: int = Field(default=15, ge=1, le=60)
     refresh_token_days: int = Field(default=7, ge=1, le=30)
     bootstrap_admin_email: str = "admin@flowtest.dev"
-    bootstrap_admin_password: str = "FlowTest-Change-Me-123!"  # noqa: S105
+    bootstrap_admin_password: str = "admin123456"  # noqa: S105
     secure_cookies: bool = False
     data_encryption_key: str = "Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI="
     data_encryption_keyring: dict[str, str] = Field(default_factory=dict)
@@ -281,7 +281,7 @@ def _validate_production(self) -> None:
         if self.runtime_profile is not RuntimeProfile.STANDALONE:
             unsafe = unsafe or self.s3_secret_key == "flowtest-local-secret"  # noqa: S105
         if unsafe or not self.secure_cookies:
-            raise ValueError("生产环境必须替换默认密钥、管理员密码并启用安全 Cookie")
+            raise ValueError("生产环境必须替换示例密钥、旧版管理员密码并启用安全 Cookie")
         if self.feature_oidc_enabled:
             oidc_urls = (
                 self.oidc_issuer_url,

backend/app/services/auth.py

@@ -238,7 +238,7 @@ async def bootstrap_administrator(session: AsyncSession) -> None:
         password_hash=password_service.hash(settings.bootstrap_admin_password),
         is_active=True,
         is_system_admin=True,
-        requires_password_change=settings.runtime_profile is not RuntimeProfile.STANDALONE,
+        requires_password_change=False,
     )
     users.add(administrator)
     await session.commit()

backend/tests/test_access_api.py

@@ -746,40 +746,35 @@ async def test_team_grants_and_direct_membership_precedence(client: AsyncClient)
     assert hidden.status_code == 404
 
 
+@pytest.mark.parametrize("runtime_profile", list(RuntimeProfile))
 @pytest.mark.asyncio
-async def test_bootstrap_administrator_is_idempotent() -> None:
+async def test_bootstrap_administrator_uses_default_login_without_forced_change(
+    runtime_profile: RuntimeProfile, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setattr(settings, "runtime_profile", runtime_profile)
+    monkeypatch.setattr(settings, "bootstrap_admin_password", "admin123456")
     test_engine = create_async_engine("sqlite+aiosqlite://", poolclass=StaticPool)
     session_maker = async_sessionmaker(test_engine, expire_on_commit=False)
     async with test_engine.begin() as connection:
         await connection.run_sync(Base.metadata.create_all)
     async with session_maker() as session:
-        await bootstrap_administrator(session)
         await bootstrap_administrator(session)
         total = await session.scalar(select(func.count()).select_from(User))
         administrator = await session.scalar(select(User))
-    assert total == 1
-    assert administrator is not None
-    assert administrator.is_system_admin
-    assert administrator.requires_password_change
-    await test_engine.dispose()
-
-
-@pytest.mark.asyncio
-async def test_standalone_bootstrap_uses_simple_password_without_forced_change(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(settings, "runtime_profile", RuntimeProfile.STANDALONE)
-    monkeypatch.setattr(settings, "bootstrap_admin_password", "admin")
-    test_engine = create_async_engine("sqlite+aiosqlite://", poolclass=StaticPool)
-    session_maker = async_sessionmaker(test_engine, expire_on_commit=False)
-    async with test_engine.begin() as connection:
-        await connection.run_sync(Base.metadata.create_all)
-    async with session_maker() as session:
+        assert total == 1
+        assert administrator is not None
+        assert administrator.is_system_admin
+        assert not administrator.requires_password_change
+        assert password_service.verify(administrator.password_hash, "admin123456")
+
+        # Upgrading an existing database must not reset a user's password or flag.
+        administrator.password_hash = password_service.hash("existing-password-123!")
+        administrator.requires_password_change = True
+        await session.commit()
         await bootstrap_administrator(session)
-        administrator = await session.scalar(select(User))
-    assert administrator is not None
-    assert not administrator.requires_password_change
-    assert password_service.verify(administrator.password_hash, "admin")
+        assert await session.scalar(select(func.count()).select_from(User)) == 1
+        assert password_service.verify(administrator.password_hash, "existing-password-123!")
+        assert administrator.requires_password_change
     await test_engine.dispose()
 
 

backend/tests/test_governance.py

@@ -24,7 +24,7 @@ def test_fixed_role_capability_matrix() -> None:
     assert not ProjectRole.VIEWER.allows(ProjectCapability.EXECUTE)
 
 
-def test_production_rejects_local_credentials_and_insecure_cookies() -> None:
+def test_production_requires_secrets_and_secure_cookies() -> None:
     with pytest.raises(ValidationError, match="生产环境"):
         Settings(_env_file=None, environment="production")
 
@@ -50,6 +50,16 @@ def test_production_rejects_local_credentials_and_insecure_cookies() -> None:
             secure_cookies=True,
         )
 
+    configured_default_admin = Settings(
+        _env_file=None,
+        environment="production",
+        secret_key="production-signing-key-with-more-than-32-bytes",
+        data_encryption_key="eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHg=",
+        s3_secret_key="production-object-storage-secret",
+        secure_cookies=True,
+    )
+    assert configured_default_admin.bootstrap_admin_password == "admin123456"
+
 
 def test_data_encryption_keyring_validates_references_and_key_material() -> None:
     encoded_key = urlsafe_b64encode(b"k" * 32).decode()

compose.yaml

@@ -3,7 +3,7 @@ x-flowtest-environment: &flowtest-environment
   FLOWTEST_DEBUG: "true"
   FLOWTEST_SECRET_KEY: ${FLOWTEST_SECRET_KEY:-local-development-only-change-before-production}
   FLOWTEST_BOOTSTRAP_ADMIN_EMAIL: ${FLOWTEST_BOOTSTRAP_ADMIN_EMAIL:-admin@flowtest.dev}
-  FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: ${FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD:-FlowTest-Change-Me-123!}
+  FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: ${FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD:-admin123456}
   FLOWTEST_SECURE_COOKIES: "false"
   FLOWTEST_DATA_ENCRYPTION_KEY: ${FLOWTEST_DATA_ENCRYPTION_KEY:-Zmxvd3Rlc3QtbG9jYWwtZW5jcnlwdGlvbi1rZXktMzI=}
   FLOWTEST_DATA_ENCRYPTION_KEYRING: '${FLOWTEST_DATA_ENCRYPTION_KEYRING:-{}}'
@@ -221,7 +221,8 @@ services:
           memory: 768M
 
   minio:
-    image: quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z
+    image: cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1
+    user: "0:0"
     command: server /data --console-address ":9001"
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:-flowtest}
@@ -232,7 +233,11 @@ services:
     volumes:
       - minio_data:/data
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test:
+        - CMD
+        - bash
+        - -ec
+        - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]'
       interval: 5s
       timeout: 5s
       retries: 20

deploy/compact/README.md

@@ -31,12 +31,13 @@ cd FlowTest
 ./deploy/compact/verify.sh
 ```
 
-脚本首次运行会生成 `deploy/compact/.env`，权限为 `0600`，其中包含随机管理员密码和随机服务密钥；
-已有文件绝不会被覆盖。启动完成后访问 <http://localhost:3000>，管理员邮箱默认为
-`admin@flowtest.dev`。登录页面的账号字段同时接受邮箱和 `admin` 别名；`admin` 会解析到配置的
-`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`。密码仍以本机 `.env` 中的
-`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD` 为准，Compact 首次登录后需要修改密码。不要复制密码到聊天、工单
-或部署日志。登录后如果账号没有项目，质量总览和项目管理页会显示“创建第一个项目”入口。
+脚本首次运行会生成权限为 `0600` 的 `deploy/compact/.env`，默认管理员账号和密码为
+`admin/admin123456`，其余服务密钥随机生成；已有文件绝不会被覆盖。启动后访问
+<http://localhost:3000>，首次登录不强制改密。`admin` 别名解析到配置的
+`FLOWTEST_BOOTSTRAP_ADMIN_EMAIL`（默认 `admin@flowtest.dev`）；可在启动前修改 `.env` 中的
+`FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD`。已有数据库账号不会被启动脚本重置。不要把 `.env` 上传到
+聊天、工单或部署日志。若账号没有项目，质量总览和项目管理页会
+显示“创建第一个项目”入口。
 源码构建使用独立 `compose.build.yaml`；当同目录存在 `images.env` 时，`start.sh` 会自动改为
 不构建、不拉取的镜像部署模式。
 

deploy/compact/compose.yaml

@@ -92,7 +92,8 @@ services:
           memory: 192M
 
   minio:
-    image: ${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}
+    image: ${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}
+    user: "0:0"
     restart: unless-stopped
     command: server /data
     environment:
@@ -104,7 +105,11 @@ services:
     volumes:
       - minio_data:/data
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test:
+        - CMD
+        - bash
+        - -ec
+        - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]'
       interval: 5s
       timeout: 5s
       retries: 20

deploy/compact/export_offline_bundle.sh

@@ -40,7 +40,7 @@ backend_source="${FLOWTEST_BACKEND_IMAGE:-flowtest/backend:local}"
 frontend_source="${FLOWTEST_FRONTEND_IMAGE:-flowtest/frontend:local}"
 postgres_source="${FLOWTEST_POSTGRES_IMAGE:-postgres:17.6-alpine}"
 redis_source="${FLOWTEST_REDIS_IMAGE:-redis:8.2.1-alpine}"
-minio_source="${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}"
+minio_source="${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}"
 
 for image_reference in \
   "${backend_source}" \

deploy/compact/generate_env.sh

@@ -15,7 +15,6 @@ fi
 
 umask 077
 secret_key="$(openssl rand -hex 32)"
-admin_password="$(openssl rand -hex 16)"
 data_encryption_key="$(openssl rand -base64 32 | tr -d '\n')"
 postgres_password="$(openssl rand -hex 24)"
 minio_password="$(openssl rand -hex 24)"
@@ -29,7 +28,7 @@ FLOWTEST_S3_PORT=9000
 FLOWTEST_PUBLIC_ORIGIN=http://localhost:3000
 FLOWTEST_SECURE_COOKIES=false
 FLOWTEST_BOOTSTRAP_ADMIN_EMAIL=admin@flowtest.dev
-FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=${admin_password}
+FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456
 FLOWTEST_SECRET_KEY=${secret_key}
 FLOWTEST_DATA_ENCRYPTION_KEY=${data_encryption_key}
 FLOWTEST_DATA_ENCRYPTION_KEYRING={}

deploy/compact/images.env.example

@@ -4,4 +4,4 @@ FLOWTEST_BACKEND_IMAGE=flowtest/backend:local
 FLOWTEST_FRONTEND_IMAGE=flowtest/frontend:local
 FLOWTEST_POSTGRES_IMAGE=postgres:17.6-alpine
 FLOWTEST_REDIS_IMAGE=redis:8.2.1-alpine
-FLOWTEST_MINIO_IMAGE=quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z
+FLOWTEST_MINIO_IMAGE=cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1

deploy/compact/publish_private_registry.sh

@@ -90,7 +90,7 @@ publish_image FLOWTEST_POSTGRES_IMAGE postgres \
 publish_image FLOWTEST_REDIS_IMAGE redis \
   "${FLOWTEST_REDIS_IMAGE:-redis:8.2.1-alpine}"
 publish_image FLOWTEST_MINIO_IMAGE minio \
-  "${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}"
+  "${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}"
 
 chmod 0644 "${temporary_output}"
 mv "${temporary_output}" "${output_environment}"

deploy/compatibility/compose.yaml

@@ -70,7 +70,8 @@ services:
       retries: 20
 
   minio:
-    image: ${FLOWTEST_MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z}
+    image: ${FLOWTEST_MINIO_IMAGE:-cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1}
+    user: "0:0"
     command: server /data
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:-flowtest}
@@ -79,7 +80,11 @@ services:
     volumes:
       - minio_data:/data
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test:
+        - CMD
+        - bash
+        - -ec
+        - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]'
       interval: 5s
       timeout: 5s
       retries: 20

deploy/standalone/.env.example

@@ -26,8 +26,8 @@ FLOWTEST_FEATURE_PERFORMANCE_LAB_ENABLED=false
 FLOWTEST_FEATURE_ENVIRONMENT_LAB_ENABLED=false
 FLOWTEST_FEATURE_RUNNER_FABRIC_ENABLED=false
 
-# start.ps1 首次运行会自动生成密钥；Standalone 初始账号为 admin，密码为 admin。
+# start.ps1 首次运行会自动生成密钥；Standalone 初始账号为 admin，密码为 admin123456。
 FLOWTEST_SECRET_KEY=replace-on-first-start
-FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin
+FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin123456
 FLOWTEST_DATA_ENCRYPTION_KEY=replace-on-first-start
 FLOWTEST_DATA_ENCRYPTION_KEYRING={}

deploy/standalone/README.md

@@ -68,9 +68,8 @@ Set-ExecutionPolicy -Scope Process Bypass
 或联网。首次运行如果尚未创建 `.env`，检查会给出提示，随后由 `start.ps1` 生成随机服务密钥。
 
 首次启动会在包根目录创建 `.env`、`data\`、`logs\` 和 `.flowtest\`。Standalone 本地初始账号固定为
-`admin`，初始密码固定为 `admin`，不会强制首次改密；新建用户和主动修改密码的最低长度为 8 位。
-该简单凭据只适用于默认的本机回环试用，若使用 `-BindHost` 对公司网段开放，应在验证完成后立即修改
-管理员密码。访问 <http://127.0.0.1:8000>。
+`admin`，初始密码固定为 `admin123456`，不会强制首次改密；新建用户和主动修改密码的最低长度为 8 位。
+该默认凭据在各环境中一致，可按需要自行修改。访问 <http://127.0.0.1:8000>。
 如果需要受控内网访问，使用明确的监听地址启动，并先由 IT 配置 Windows 防火墙：
 
 ```powershell

deploy/standalone/preflight.ps1

@@ -118,7 +118,7 @@ if (Test-Path -LiteralPath $envFile) {
         }
     }
 } else {
-    Add-PreflightWarning("尚未找到 .env；首次 start.ps1 会生成随机密钥，并使用 Standalone 初始账号 admin/admin")
+    Add-PreflightWarning("尚未找到 .env；首次 start.ps1 会生成随机密钥，并使用 Standalone 初始账号 admin/admin123456")
 }
 
 $drive = New-Object -TypeName System.IO.DriveInfo -ArgumentList ([System.IO.Path]::GetPathRoot($Root))

deploy/standalone/start.ps1

@@ -26,16 +26,12 @@ function Ensure-EnvFile {
         "FLOWTEST_SECRET_KEY=replace-on-first-start",
         "FLOWTEST_SECRET_KEY=$(New-Secret 32)"
     )
-    $content = $content.Replace(
-        "FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=replace-on-first-start",
-        "FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD=admin"
-    )
     $content = $content.Replace(
         "FLOWTEST_DATA_ENCRYPTION_KEY=replace-on-first-start",
         "FLOWTEST_DATA_ENCRYPTION_KEY=$(New-Secret 32)"
     )
     Set-Content -Path $EnvFile -Value $content -Encoding UTF8 -NoNewline
-    Write-Host "已创建 .env；Standalone 初始账号为 admin，密码为 admin。"
+    Write-Host "已创建 .env；Standalone 初始账号为 admin，密码为 admin123456。"
 }
 
 function Find-Python {

deploy/upgrade/compose.yaml

@@ -3,6 +3,7 @@ x-flowtest-environment: &flowtest-environment
   FLOWTEST_DEBUG: "true"
   FLOWTEST_SECRET_KEY: ${FLOWTEST_UPGRADE_SECRET_KEY:-upgrade-rehearsal-only-change-me-now}
   FLOWTEST_BOOTSTRAP_ADMIN_EMAIL: admin@flowtest.dev
+  # This rehearsal preserves the V2 account and its historical 12+ character password.
   FLOWTEST_BOOTSTRAP_ADMIN_PASSWORD: FlowTest-Change-Me-123!
   FLOWTEST_SECURE_COOKIES: "false"
   FLOWTEST_DATA_ENCRYPTION_KEY: ${FLOWTEST_UPGRADE_DATA_ENCRYPTION_KEY:-Zmxvd3Rlc3QtdXBncmFkZS1yZWhlYXJzYWwta2V5LTM=}
@@ -110,15 +111,20 @@ services:
       retries: 30
 
   minio:
-    image: quay.io/minio/minio:RELEASE.2025-07-23T15-54-02Z
+    image: cgr.dev/chainguard/minio@sha256:bd014394a80898e68c149f2311fdf8d5a2c2f3bb2c33b9327ae6d02b4b065ae1
+    user: "0:0"
     command: server /data
     environment:
       MINIO_ROOT_USER: flowtest
       MINIO_ROOT_PASSWORD: flowtest-local-secret
     volumes:
       - minio_data:/data
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test:
+        - CMD
+        - bash
+        - -ec
+        - 'exec 3<>/dev/tcp/127.0.0.1/9000; printf "GET /minio/health/live HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3; IFS= read -r status <&3; [[ "$$status" == *" 200 "* ]]'
       interval: 3s
       timeout: 5s
       retries: 30

docs/adr/0026-explicit-runtime-profiles-and-compact-deployment.md

@@ -3,6 +3,9 @@
 状态：Accepted
 日期：2026-08-19
 
+第 7 项的随机管理员密码决策已由 [ADR 0055](0055-unified-default-administrator-login.md) 替代；
+其他部署拓扑和密钥生成规则不变。
+
 ## 背景
 
 Full Compose 为容量、安全和多执行面验收同时启动 PostgreSQL、Redis、MinIO、Redpanda、多类 Worker、