sub2api

7,658 Commits 46 Branches 62 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
shaw	6e315616ed	fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850 ) Fresh Docker installs created the admin as admin@sub2api.local and accepted any ADMIN_PASSWORD (e.g. "123456"), making them easy brute-force targets. - Generate a random admin-<12 hex>@sub2api.local login email when ADMIN_EMAIL is empty; drop the fixed default from .env.example and the compose files, and have docker-deploy.sh write a random ADMIN_EMAIL. - Validate user-supplied ADMIN_PASSWORD (8-72 bytes) and ADMIN_EMAIL on the auto-setup path, only when an admin is actually about to be created, so existing deployments are never blocked at startup. - Align validateEmail with the login endpoint's email binding so setup can no longer create an admin that can never log in (e.g. "a@b", "Name <a@b.com>"). - Cap validatePassword at bcrypt's 72-byte limit; the CLI reuses it and now defaults to a random admin email instead of admin@example.com. - Update READMEs/deploy docs to stop suggesting guessable credentials.	2026-10-07 09:27:36 +08:00
shaw	c8eff34388	chore: update readme	2026-03-09 16:25:56 +08:00
shaw	5cda979209	feat(deploy): 优化 Docker 部署体验，新增一键部署脚本 ## 新增功能 - 新增 docker-compose.local.yml：使用本地目录存储数据，便于迁移和备份 - 新增 docker-deploy.sh：一键部署脚本，自动生成安全密钥（JWT_SECRET、TOTP_ENCRYPTION_KEY、POSTGRES_PASSWORD） - 新增 deploy/.gitignore：忽略运行时数据目录 ## 优化改进 - docker-compose.local.yml 包含 PGDATA 环境变量修复，解决 PostgreSQL 18 Alpine 数据丢失问题 - 脚本自动设置 .env 文件权限为 600，增强安全性 - 脚本显示生成的凭证，方便用户记录 ## 文档更新 - 更新 README.md（英文版）：新增"快速开始"章节，添加部署版本对比表 - 更新 README_CN.md（中文版）：同步英文版更新 - 更新 deploy/README.md：详细说明两种部署方式和迁移方法 ## 使用方式一键部署： ```bash curl -sSL https://raw.githubusercontent.com/Wei-Shaw/sub2api/main/deploy/docker-deploy.sh \| bash docker-compose -f docker-compose.local.yml up -d ``` 轻松迁移： ```bash tar czf sub2api-complete.tar.gz deploy/ # 传输到新服务器后直接解压启动即可 ```	2026-02-02 16:17:07 +08:00

Author

SHA1

Message

Date

shaw

6e315616ed

fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850 )

Fresh Docker installs created the admin as admin@sub2api.local and accepted
any ADMIN_PASSWORD (e.g. "123456"), making them easy brute-force targets.

- Generate a random admin-<12 hex>@sub2api.local login email when
  ADMIN_EMAIL is empty; drop the fixed default from .env.example and the
  compose files, and have docker-deploy.sh write a random ADMIN_EMAIL.
- Validate user-supplied ADMIN_PASSWORD (8-72 bytes) and ADMIN_EMAIL on the
  auto-setup path, only when an admin is actually about to be created, so
  existing deployments are never blocked at startup.
- Align validateEmail with the login endpoint's email binding so setup can no
  longer create an admin that can never log in (e.g. "a@b", "Name <a@b.com>").
- Cap validatePassword at bcrypt's 72-byte limit; the CLI reuses it and now
  defaults to a random admin email instead of admin@example.com.
- Update READMEs/deploy docs to stop suggesting guessable credentials.

2026-10-07 09:27:36 +08:00

shaw

c8eff34388

chore: update readme

2026-03-09 16:25:56 +08:00

shaw

5cda979209

feat(deploy): 优化 Docker 部署体验，新增一键部署脚本

## 新增功能

- 新增 docker-compose.local.yml：使用本地目录存储数据，便于迁移和备份
- 新增 docker-deploy.sh：一键部署脚本，自动生成安全密钥（JWT_SECRET、TOTP_ENCRYPTION_KEY、POSTGRES_PASSWORD）
- 新增 deploy/.gitignore：忽略运行时数据目录

## 优化改进

- docker-compose.local.yml 包含 PGDATA 环境变量修复，解决 PostgreSQL 18 Alpine 数据丢失问题
- 脚本自动设置 .env 文件权限为 600，增强安全性
- 脚本显示生成的凭证，方便用户记录

## 文档更新

- 更新 README.md（英文版）：新增"快速开始"章节，添加部署版本对比表
- 更新 README_CN.md（中文版）：同步英文版更新
- 更新 deploy/README.md：详细说明两种部署方式和迁移方法

## 使用方式

一键部署：
```bash
curl -sSL https://raw.githubusercontent.com/Wei-Shaw/sub2api/main/deploy/docker-deploy.sh | bash
docker-compose -f docker-compose.local.yml up -d
```

轻松迁移：
```bash
tar czf sub2api-complete.tar.gz deploy/
# 传输到新服务器后直接解压启动即可
```

2026-02-02 16:17:07 +08:00