支持 Ubuntu 一键部署与 PM2，并增加系统设置改密。

默认账号改为 admin/admin123，去掉 Windows 部署说明，与客户端同套部署流程。

Co-authored-by: Cursor <cursoragent@cursor.com>

app.py

@@ -22,10 +22,12 @@ ROOT = Path(__file__).resolve().parent
 if str(ROOT) not in sys.path:
     sys.path.insert(0, str(ROOT))
 
-load_dotenv(ROOT / ".env")
+ENV_PATH = ROOT / ".env"
+load_dotenv(ENV_PATH)
 
 from lib.bridge_client_lib import pull_all_enabled
 from lib.db_lib import init_db
+from lib.env_lib import apply_env_updates
 from lib.instances_lib import (
     create_instance,
     delete_instance,
@@ -37,10 +39,14 @@ from lib.sso_lib import build_embed_open_url
 
 APP_HOST = (os.getenv("APP_HOST") or "0.0.0.0").strip() or "0.0.0.0"
 APP_PORT = int(os.getenv("APP_PORT") or 5100)
-HUB_USERNAME = (os.getenv("HUB_USERNAME") or "admin").strip() or "admin"
-HUB_PASSWORD = (os.getenv("HUB_PASSWORD") or "change-me").strip() or "change-me"
 SECRET = (os.getenv("FLASK_SECRET_KEY") or "hub-dev-secret").strip()
 
+# 可变登录态:系统设置页可改,并立刻生效
+_auth = {
+    "username": (os.getenv("HUB_USERNAME") or "admin").strip() or "admin",
+    "password": (os.getenv("HUB_PASSWORD") or "admin123").strip() or "admin123",
+}
+
 app = Flask(__name__)
 app.secret_key = SECRET
 app.config["TEMPLATES_AUTO_RELOAD"] = True
@@ -48,6 +54,23 @@ app.config["TEMPLATES_AUTO_RELOAD"] = True
 init_db()
 
 
+def hub_username() -> str:
+    return _auth["username"]
+
+
+def hub_password() -> str:
+    return _auth["password"]
+
+
+def set_hub_credentials(username: str, password: str) -> None:
+    u = (username or "").strip() or "admin"
+    p = password if password is not None else ""
+    _auth["username"] = u
+    _auth["password"] = p
+    os.environ["HUB_USERNAME"] = u
+    os.environ["HUB_PASSWORD"] = p
+
+
 def login_required(f):
     @wraps(f)
     def wrapped(*args, **kwargs):
@@ -65,7 +88,7 @@ def login():
     if request.method == "POST":
         u = (request.form.get("username") or "").strip()
         p = request.form.get("password") or ""
-        if u == HUB_USERNAME and p == HUB_PASSWORD:
+        if u == hub_username() and p == hub_password():
             session["logged_in"] = True
             session.permanent = True
             nxt = (request.args.get("next") or request.form.get("next") or "/").strip() or "/"
@@ -125,6 +148,50 @@ def instances_page():
     return render_template("instances.html", instances=list_instances())
 
 
+@app.route("/settings", methods=["GET", "POST"])
+@login_required
+def settings_page():
+    if request.method == "POST":
+        current_pw = request.form.get("current_password") or ""
+        new_username = (request.form.get("new_username") or "").strip()
+        new_password = request.form.get("new_password") or ""
+        confirm = request.form.get("confirm_password") or ""
+
+        if current_pw != hub_password():
+            flash("当前密码错误")
+            return redirect(url_for("settings_page"))
+        if len(new_username) < 2 or len(new_username) > 64:
+            flash("用户名长度需为 2–64")
+            return redirect(url_for("settings_page"))
+        if any(ch.isspace() for ch in new_username):
+            flash("用户名不能包含空格")
+            return redirect(url_for("settings_page"))
+
+        updates: dict[str, str] = {"HUB_USERNAME": new_username}
+        final_password = hub_password()
+        if new_password or confirm:
+            if len(new_password) < 6:
+                flash("新密码至少 6 位")
+                return redirect(url_for("settings_page"))
+            if new_password != confirm:
+                flash("两次输入的新密码不一致")
+                return redirect(url_for("settings_page"))
+            updates["HUB_PASSWORD"] = new_password
+            final_password = new_password
+
+        try:
+            apply_env_updates(ENV_PATH, updates)
+        except OSError as exc:
+            flash(f"写入 .env 失败: {exc}")
+            return redirect(url_for("settings_page"))
+
+        set_hub_credentials(new_username, final_password)
+        flash("账号已更新,立即生效")
+        return redirect(url_for("settings_page"))
+
+    return render_template("settings.html", current_username=hub_username())
+
+
 @app.route("/desk")
 @login_required
 def desk():