refactor(docker): use ADMIN_USER/ADMIN_PASSWORD env vars for flexible admin account

- Add ADMIN_USER and ADMIN_PASSWORD to .env (default: websoft9)
- Remove ADMIN_PASSWORD from Dockerfile ENV (security: avoid baking into image)
- Update entrypoint.sh to create/update admin user dynamically
- Fix log directory permissions for dynamic admin user
- Update supervisord.conf to run apphub as %(ENV_ADMIN_USER)s
- Add story4.2 implementation artifact

Author: root

docker/cockpit/.env

@@ -0,0 +1,22 @@
+# Websoft9 Cockpit Container Configuration
+# This file is used by docker-compose.yml
+
+# Container name
+CONTAINER_NAME=websoft9-cockpit
+
+# Port mappings
+HTTP_PORT=9091
+
+# Image
+IMAGE_TAG=latest
+
+# Volumes
+COMPOSE_DATA_PATH=/data/compose
+PORTAINER_DATA_VOLUME=cockpit_portainer_data
+
+# Restart policy
+RESTART_POLICY=unless-stopped
+
+# Admin credentials (can be customized)
+ADMIN_USER=websoft9
+ADMIN_PASSWORD=websoft9

docker/cockpit/Dockerfile

@@ -50,7 +50,7 @@ COPY plugins/appstore/build /usr/share/cockpit/appstore
 COPY plugins/backup/build /usr/share/cockpit/backup
 COPY plugins/gitea/build /usr/share/cockpit/gitea
 COPY plugins/myapps/build /usr/share/cockpit/myapps
-COPY plugins/navigator/build /usr/share/cockpit/navigator
+COPY plugins/cockpit-files/dist /usr/share/cockpit/cockpit-files
 COPY plugins/nginx/build /usr/share/cockpit/nginx
 COPY plugins/portainer/build /usr/share/cockpit/portainer
 COPY plugins/settings/build /usr/share/cockpit/settings
@@ -102,7 +102,10 @@ RUN sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/
     sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
     ssh-keygen -A
 
-# 创建默认管理员账户（容器内认证用，用于 Cockpit 认证）
+# 环境变量：默认管理员用户名（密码通过运行时环境变量传递）
+ENV ADMIN_USER=websoft9
+
+# 创建默认管理员账户（容器启动时会用环境变量覆盖）
 RUN useradd -m -s /bin/bash -G sudo websoft9 && \
     echo "websoft9:websoft9" | chpasswd && \
     echo "websoft9 ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

docker/cockpit/entrypoint.sh

@@ -1,10 +1,29 @@
 #!/bin/bash
 set -e
 
+# 使用环境变量设置管理员账户（默认值在 Dockerfile 中定义）
+ADMIN_USER=${ADMIN_USER:-websoft9}
+ADMIN_PASSWORD=${ADMIN_PASSWORD:-websoft9}
+
+# 确保管理员用户存在并更新密码
+if ! id "$ADMIN_USER" &>/dev/null; then
+    echo "Creating admin user: $ADMIN_USER"
+    useradd -m -s /bin/bash -G sudo "$ADMIN_USER"
+fi
+echo "$ADMIN_USER:$ADMIN_PASSWORD" | chpasswd
+echo "$ADMIN_USER ALL=(ALL) NOPASSWD:ALL" | tee /etc/sudoers.d/$ADMIN_USER > /dev/null
+chmod 0440 /etc/sudoers.d/$ADMIN_USER
+
 # 创建必要的运行时目录
 mkdir -p /run/dbus /run/cockpit /run/sshd /var/log/supervisor /var/log/nginx /portainer_data /data/compose
 mkdir -p /var/lib/gitea/{custom,data,log,data/gitea-repositories,data/sessions,data/avatars,data/repo-avatars,data/attachments}
 mkdir -p /websoft9/apphub/logs /websoft9/apphub/src/config
+mkdir -p /home/$ADMIN_USER/logs
+
+# 确保日志目录权限正确（使用管理员用户）
+chown -R "$ADMIN_USER:$ADMIN_USER" /websoft9/apphub/logs /home/$ADMIN_USER/logs
+chmod -R 755 /websoft9/apphub/logs /home/$ADMIN_USER/logs
+
 rm -f /run/dbus/pid /var/run/dbus/pid
 
 # Run service initialization script
@@ -16,9 +35,9 @@ chown -R git:git /var/lib/gitea /etc/gitea 2>/dev/null || true
 
 # 初始化 Gitea 管理员账户（仅首次运行）
 if [ ! -f /var/lib/gitea/.initialized ]; then
-    echo "Initializing Gitea admin user..."
+    echo "Initializing Gitea admin user: $ADMIN_USER"
     # 等待 Gitea 数据库初始化（在后台启动后）
-    (sleep 15 && su -c '/usr/local/bin/gitea admin user create --admin --username websoft9 --password websoft9 --email admin@websoft9.com --config /etc/gitea/app.ini 2>/dev/null || true' git && touch /var/lib/gitea/.initialized) &
+    (sleep 15 && su -c "/usr/local/bin/gitea admin user create --admin --username $ADMIN_USER --password $ADMIN_PASSWORD --email admin@websoft9.com --config /etc/gitea/app.ini 2>/dev/null || true" git && touch /var/lib/gitea/.initialized) &
 fi
 
 # 确保 dbus 系统目录存在
@@ -44,7 +63,7 @@ chmod 644 /etc/cockpit/cockpit.conf 2>/dev/null || true
 nginx -t
 
 echo "=== Websoft9 Console Starting ==="
-echo "Cockpit:   http://localhost/ (websoft9/websoft9)"
+echo "Cockpit:   http://localhost/ ($ADMIN_USER/$ADMIN_PASSWORD)"
 echo "Portainer: http://localhost/w9deployment/"
 echo "Gitea:     http://localhost/w9git/"
 echo "Apphub:    http://localhost/w9api/"

docker/cockpit/supervisord.conf

@@ -82,7 +82,7 @@ directory=/websoft9/apphub
 priority=40
 autostart=true
 autorestart=true
-user=root
+user=%(ENV_ADMIN_USER)s
 stdout_logfile=/var/log/supervisor/apphub.log
 stderr_logfile=/var/log/supervisor/apphub-error.log
 stdout_logfile_maxbytes=10MB
@@ -93,7 +93,7 @@ command=cron -f
 priority=42
 autostart=true
 autorestart=true
-user=root
+user=%(ENV_ADMIN_USER)s
 stdout_logfile=/var/log/supervisor/apphub-cron.log
 stderr_logfile=/var/log/supervisor/apphub-cron-error.log
 stdout_logfile_maxbytes=10MB