mirror of https://github.com/TencentCloud/Octop.git synced 2026-09-30 09:17:25 +08:00

Files

T

veenyi cf9d700d61 fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

根因：应用密码策略（src/octop/infra/users/password.py）的常见弱密码黑名单包含 octop123，
而 FnOS FPK 把初始密码写死为 Octop123，首次启动 octop init 报 "password is too common"
直接退出（"Octop process exited early"），全新安装的 native / docker FPK 均无法启动。

修复内容：
- 安装向导（wizard/install，native + docker）提供两种密码方式：
  ① 自己输入密码：install_init / install_callback 按应用侧策略预校验（≥8 位、
     含字母和数字、不在常见弱密码黑名单），无效密码在安装阶段直接拦截并中文提示；
  ② 自动生成随机密码（推荐）：octop_generate_password 生成 16 位强密码。
- 随机/自定义密码双通道送达：
  ① 应用「设置」窗口（wizard/config）顶部直接显示当前账号与密码（安装/改密时
     由回调渲染占位符模板），用户免翻文件；
  ② 数据目录 octop-login.txt 回落备份，永久保留、随改密同步更新。
- 启动器与容器入口三重兜底：.env 无密码时自动生成；init 因密码策略被拒时
  自动改用随机密码重试一次，并回写 .env 保持一致 —— 存量坏 .env（Octop123）
  升级后首次启动即被救活，不再依赖用户手工清理。
- 应用「设置」窗口支持改密：保持不变 / 随机生成 / 自定义（config_init 前置校验），
  本地版走官方 CLI `octop user passwd` 离线改密（停服→改密→启服防写库冲突），
  Docker 版走 `docker exec octop octop user passwd`；凭据三处同步（.env /
  octop-login.txt / 设置窗口显示）。
- 官方 CLI 管理保障：安装回调注册 octop / octop-cli 到 PATH 并做 `octop version`
  冒烟验证（结果写入安装日志）。
- docker/docker-entrypoint.sh：未设置 OCTOP_DEFAULT_PASSWORD 时自动生成随机密码，
  指定密码被策略拒绝时自动回退随机；credential.txt 增加访问地址行。
- compose / .env.example / README / user-guide 移除 Octop123 默认值与宣传文案。

本地验证：19 个 shell 脚本 bash -n 全过；7 个向导 JSON 全部合法；密码生成 300/300
通过字符集/长度/首字母/末位数字断言；octop_validate_password 与官方
validate_password_policy 对拍 19/19 一致、黑名单 14 项逐字一致；渲染链端到端模拟
（生成→校验→回落保存→设置窗口渲染→JSON 复检）通过。

2026-09-12 08:15:24 +08:00

postgres

Feat/postgresql dual backend (#60 )

2026-07-24 14:45:53 +08:00

docker_build.sh

docs(mirrors): optimize default China mirror examples to Tencent Cloud

2026-07-31 19:58:13 +08:00

docker-compose.mobile.yml

fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

2026-09-12 08:15:24 +08:00

docker-compose.postgres.yml

Feat/postgresql dual backend (#60 )

2026-07-24 14:45:53 +08:00

docker-compose.yml

fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

2026-09-12 08:15:24 +08:00

docker-entrypoint.sh

fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

2026-09-12 08:15:24 +08:00

Dockerfile

chore: make Playwright Chromium opt-in in installers and images (#537 )

2026-09-03 14:47:26 +08:00

README_CN.md

fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

2026-09-12 08:15:24 +08:00

README.md

fix(fnos): 安装向导接管管理员密码，根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502 )

2026-09-12 08:15:24 +08:00

README.md

Octop Docker Deployment

This directory contains the Docker build and deployment assets for Octop.

Files

File	Description
`Dockerfile`	Multi-stage image definition (build context is the repo root)
`../.dockerignore`	Build context ignore rules (applies to both Podman and BuildKit)
`docker_build.sh`	Build image from source (BuildKit cache enabled by default)
`docker-compose.yml`	One-command local / self-hosted deployment
`docker-compose.postgres.yml`	PostgreSQL (+ pgvector) for dual-backend dev/tests
`postgres/init-vector.sql`	Instance-level `CREATE EXTENSION vector` (initdb.d; not Octop migrations)
`docker-entrypoint.sh`	Container entrypoint: first-run init + start server

Quick start

Option 1: Compose (recommended)

From the repository root:

docker compose -f docker/docker-compose.yml up -d --build

Open http://localhost:8088. If OCTOP_DEFAULT_PASSWORD is unset, a strong random password is generated on first init and written to /data/.octop/credential.txt; if it is set, it is used as-is (must be ≥8 characters with letters and digits; passwords rejected by the app password policy — e.g. common ones — fall back to a random one automatically). Change the password immediately after first login.

Option 2: Build script

bash docker/docker_build.sh
docker run -d \
  --name octop \
  -p 8088:8088 \
  -v octop-data:/data/.octop \
  -e HOME=/data \
  octop:latest

Faster downloads (China mirrors)

Pass mirror env vars when building:

PIP_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple \
PIP_TRUSTED_HOST=mirrors.cloud.tencent.com \
NPM_REGISTRY=https://mirrors.cloud.tencent.com/npm/ \
APT_MIRROR=mirrors.cloud.tencent.com \
bash docker/docker_build.sh

Environment variables

Variable	Default	Description
`HOME`	`/data`	Must be `/data` so `~/.octop` maps to the data volume
`OCTOP_PORT`	`8088`	HTTP listen port
`OCTOP_DEFAULT_PASSWORD`	(unset)	First-run admin password (≥8 chars, letters + digits). When unset, a random password is generated and written to `credential.txt`
`OCTOP_ADMIN_USERNAME`	`admin`	Initial admin username
`OCTOP_DATABASE_URL`	—	PostgreSQL DSN (or other `OCTOP_DATABASE_*`; see configuration.md)
`OCTOP_DATABASE_DRIVER`	—	`sqlite` \| `postgresql` when overriding defaults via env
`OPENAI_API_KEY`	—	OpenAI-compatible API key
`DASHSCOPE_API_KEY`	—	Alibaba DashScope API key

For Compose, put these in docker/.env. Values only reach the container if listed under environment: in docker-compose.yml (Compose interpolates .env; it does not auto-export every key). Alternatively write the same keys into the mounted data dir as ~/.octop/env.

Data persistence

Compose mounts host ~/.octop → container /data/.octop
docker run example uses named volume octop-data
First boot runs octop init; credentials are written to /data/.octop/credential.txt. With OCTOP_DEFAULT_PASSWORD unset a random password is generated; a specified password that the app password policy rejects falls back to a random one automatically (the container must never fail its first init because of a weak default).

Health check

The image probes GET /api/health:

curl http://localhost:8088/api/health

Operations

docker logs -f octop
docker exec -it octop octop --version
docker compose -f docker/docker-compose.yml down
docker compose -f docker/docker-compose.yml up -d --build