feat: CLI 改密、自定义 TLS、移动端适配与扩展校验

- 新增 one-kvm user set-password（交互式），改密后吊销该用户全部会话 - /api/config/web 支持 PEM 证书/密钥上传与清除，响应含 has_custom_cert - 移动端：ActionBar 溢出菜单、ATX/粘贴底部 Sheet、BrandMark 与控制台等响应式优化 - GOSTC：校验服务器地址非空，管理器启动条件与 HTTP 热更新一致 - RustDesk：中继密钥 relay_key 校验为标准 Base64 且解码后恰好 32 字节 - StatusCard、InfoBar：合并精简冗余状态信息
2026-07-29 15:31:46 +08:00 · 2026-04-12 19:26:52 +08:00
parent d0c0852fbb
commit 9653e16a68
27 changed files with 1527 additions and 629 deletions
--- a/web/src/i18n/en-US.ts
+++ b/web/src/i18n/en-US.ts
@@ -41,6 +41,7 @@ export default {
    expand: 'Expand',
    toggleTheme: 'Toggle theme',
    toggleLanguage: 'Toggle language',
+    retry: 'Retry',
  },
  api: {
    operationFailed: 'Operation Failed',
@@ -64,6 +65,7 @@ export default {
    enterPassword: 'Enter password',
    loginFailed: 'Login failed',
    invalidPassword: 'Invalid username or password',
+    systemNotInitialized: 'System not initialized. Complete setup first.',
    changePassword: 'Change Password',
    currentPassword: 'Current Password',
    currentPasswordPlaceholder: 'Enter current password',
@@ -78,6 +80,9 @@ export default {
    userNotFound: 'User not found',
    sessionExpired: 'Session expired',
    loggedInElsewhere: 'Logged in elsewhere',
+    forgotPassword: 'Forgot password',
+    forgotPasswordHint:
+      'Forgot your password? On the host running One-KVM, open a terminal and run one-kvm user set-password, then enter and confirm the new password when prompted.',
  },
  status: {
    connected: 'Connected',
@@ -105,7 +110,7 @@ export default {
    fullscreen: 'Fullscreen',
    fullscreenTip: 'Toggle fullscreen mode',
    // Video Config
-    videoConfig: 'Video Config',
+    videoConfig: 'Video',
    streamSettings: 'Stream Settings',
    deviceSettings: 'Device Settings',
    videoMode: 'Mode',
@@ -137,7 +142,7 @@ export default {
    multiSourceCodecLocked: '{sources} are enabled. Current codec is locked.',
    multiSourceVideoParamsWarning: '{sources} are enabled. Changing video device and input parameters will interrupt the stream.',
    // HID Config
-    hidConfig: 'Mouse & HID',
+    hidConfig: 'HID',
    mouseSettings: 'Mouse Settings',
    hidDeviceSettings: 'HID Device Settings',
    positioningMode: 'Positioning Mode',
@@ -497,7 +502,6 @@ export default {
    buildInfo: 'Build Info',
    detectDevices: 'Detect Devices',
    detecting: 'Detecting...',
-    builtWith: "Copyright {'@'}2025 SilentWind",
    networkSettings: 'Network Settings',
    msdSettings: 'MSD Settings',
    atxSettings: 'ATX Settings',
@@ -524,10 +528,43 @@ export default {
    addBindAddress: 'Add address',
    bindAddressListEmpty: 'Add at least one IP address.',
    httpsEnabled: 'Enable HTTPS',
-    httpsEnabledDesc: 'Enable HTTPS encrypted connection (self-signed certificate will be auto-generated)',
+    httpsEnabledDesc: 'Enable HTTPS encrypted connection (a self-signed certificate is generated if none is specified)',
+    // Port config
+    portConfig: 'Port & Protocol',
+    portConfigDesc: 'The service runs on a single port at a time, determined by the HTTPS toggle',
+    httpPortReserved: 'HTTP port (reserved)',
+    httpsPortReserved: 'HTTPS port (reserved)',
+    previewUrl: 'Access URL preview',
+    // Listen address
+    listenAddress: 'Listen Address',
+    listenAddressDesc: 'Configure which network interfaces the web server listens on',
+    bindModeAllDesc: '0.0.0.0 — Listen on all network interfaces',
+    bindModeLocalDesc: '127.0.0.1 — Allow local access only',
+    bindModeCustomDesc: 'Specify a list of IP addresses',
+    effectiveAddresses: 'Listen address preview',
+    // SSL certificate
+    sslCertificate: 'SSL Certificate',
+    sslCertificateDesc: 'Upload a custom PEM certificate to replace the self-signed one, restart required',
+    sslCertCustom: 'Custom Certificate',
+    sslCertSelfSigned: 'Self-Signed',
+    sslCertActive: 'Custom certificate is active',
+    sslCertClear: 'Revert to Self-Signed',
+    sslCertSave: 'Save Certificate',
+    sslCertPem: 'Certificate (.crt / .pem)',
+    sslKeyPem: 'Private Key (.key)',
+    sslCertPemPlaceholder: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
+    sslKeyPemPlaceholder: '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----',
+    sslCertSaved: 'Certificate saved, restart to apply',
+    sslCertCleared: 'Reverted to self-signed certificate, restart to apply',
    restartRequired: 'Restart Required',
    restartMessage: 'Web server configuration saved. A restart is required for changes to take effect.',
    restarting: 'Restarting...',
+    autoRestarting: 'Restarting automatically',
+    autoRestartingDesc: 'Configuration saved. Will redirect to the new address once the service is back...',
+    autoRestartingHttpsDesc: 'Service is restarting. A redirect link will appear in {sec}s...',
+    autoRestartFailed: 'Auto-restart timed out. Please refresh the page or check the service status.',
+    httpsManualRedirectTitle: 'Click the link below to open the new address',
+    httpsManualRedirectDesc: 'HTTPS with a self-signed certificate requires browser approval. Click the link and choose "Proceed" on the security warning.',
    onlineUpgrade: 'Online Upgrade',
    onlineUpgradeDesc: 'Check and upgrade One-KVM',
    updateChannel: 'Update Channel',
@@ -557,7 +594,6 @@ export default {
    authSettingsDesc: 'Single-user access and session behavior',
    allowMultipleSessions: 'Allow multiple web sessions',
    allowMultipleSessionsDesc: 'When disabled, a new login will kick the previous session.',
-    singleUserSessionNote: 'Single-user mode is enforced; only session concurrency is configurable.',
    // User management
    userManagement: 'User Management',
    userManagementDesc: 'Manage user accounts and permissions',
@@ -817,27 +853,19 @@ export default {
    version: 'Version',
    uptime: 'Uptime',
    running: 'Running',
-    mode: 'Mode',
    format: 'Format',
    resolution: 'Resolution',
-    targetFps: 'Target FPS',
-    fps: 'Actual FPS',
+    fps: 'FPS',
    clients: 'Clients',
    backend: 'Backend',
-    initialized: 'Initialized',
-    yes: 'Yes',
-    no: 'No',
    mouse: 'Mouse',
    mouseSupport: 'Mouse Support',
    currentMode: 'Current Mode',
    absolute: 'Absolute',
    relative: 'Relative',
-    connection: 'Connection',
    channel: 'Channel',
    networkError: 'Network Error',
    disconnected: 'Disconnected',
-    availability: 'Availability',
-    errorCode: 'Error Code',
    hidUnavailable: 'HID Unavailable',
    sampleRate: 'Sample Rate',
    channels: 'Channels',
@@ -889,6 +917,7 @@ export default {
      title: 'GOSTC NAT Traversal',
      desc: 'NAT traversal via GOSTC',
      addr: 'Server Address',
+      addrPlaceholder: 'Hostname or IP (required)',
      key: 'Client Key',
      tls: 'Enable TLS',
    },
@@ -915,9 +944,9 @@ export default {
      relayServerPlaceholder: 'hbbr.example.com:21117',
      relayServerHint: 'Relay server address (port optional, defaults to 21117). Auto-derived if empty',
      relayKey: 'Relay Key',
-      relayKeyPlaceholder: 'Enter relay server key',
-      relayKeySet: '••••••••',
-      relayKeyHint: 'Authentication key for relay server (if server uses -k option)',
+      relayKeyPlaceholder: 'e.g. pLU0pEj2IZnNVKzrIO1pIdwGA3dOVJJLkFIYGOCGH1E=',
+      relayKeySet: 'Saved (32-byte Base64, usually 44 chars; leave empty and save to keep)',
+      relayKeyHint: 'Same as hbbs/hbbr -k: standard Base64 decoding to exactly 32 bytes (typically 44 characters including trailing =)',
      deviceInfo: 'Device Info',
      deviceId: 'Device ID',
      deviceIdHint: 'Use this ID in RustDesk client to connect',
--- a/web/src/i18n/zh-CN.ts
+++ b/web/src/i18n/zh-CN.ts
@@ -41,6 +41,7 @@ export default {
    expand: '展开',
    toggleTheme: '切换主题',
    toggleLanguage: '切换语言',
+    retry: '重试',
  },
  api: {
    operationFailed: '操作失败',
@@ -64,6 +65,7 @@ export default {
    enterPassword: '请输入密码',
    loginFailed: '登录失败',
    invalidPassword: '用户名或密码错误',
+    systemNotInitialized: '系统尚未初始化，请先完成向导设置。',
    changePassword: '修改密码',
    currentPassword: '当前密码',
    currentPasswordPlaceholder: '请输入当前密码',
@@ -78,6 +80,9 @@ export default {
    userNotFound: '用户不存在',
    sessionExpired: '会话已过期',
    loggedInElsewhere: '已在别处登录',
+    forgotPassword: '忘记密码',
+    forgotPasswordHint:
+      '忘记密码？在运行本服务的设备上打开终端，执行 one-kvm user set-password，按提示输入并确认新密码即可重置。',
  },
  status: {
    connected: '已连接',
@@ -497,7 +502,6 @@ export default {
    buildInfo: '构建信息',
    detectDevices: '探测设备',
    detecting: '探测中...',
-    builtWith: "版权信息 {'@'}2025 SilentWind",
    networkSettings: '网络设置',
    msdSettings: 'MSD 设置',
    atxSettings: 'ATX 设置',
@@ -524,10 +528,43 @@ export default {
    addBindAddress: '添加地址',
    bindAddressListEmpty: '请至少填写一个 IP 地址。',
    httpsEnabled: '启用 HTTPS',
-    httpsEnabledDesc: '启用 HTTPS 加密连接（将自动生成自签名证书）',
+    httpsEnabledDesc: '启用 HTTPS 加密连接（未指定证书将生成自签证书）',
+    // Port config
+    portConfig: '端口与协议',
+    portConfigDesc: '服务一次只运行在一个端口上，由 HTTPS 开关决定使用哪个端口',
+    httpPortReserved: 'HTTP 端口（备用）',
+    httpsPortReserved: 'HTTPS 端口（备用）',
+    previewUrl: '访问地址预览',
+    // Listen address
+    listenAddress: '监听地址',
+    listenAddressDesc: '配置 Web 服务监听哪些网络接口',
+    bindModeAllDesc: '0.0.0.0 — 监听所有网络接口',
+    bindModeLocalDesc: '127.0.0.1 — 仅允许本机访问',
+    bindModeCustomDesc: '指定一组 IP 地址',
+    effectiveAddresses: '监听地址预览',
+    // SSL certificate
+    sslCertificate: 'SSL 证书',
+    sslCertificateDesc: '上传自定义 PEM 证书替换自签名证书，修改后需要重启生效',
+    sslCertCustom: '自定义证书',
+    sslCertSelfSigned: '自签名证书',
+    sslCertActive: '自定义证书已启用',
+    sslCertClear: '恢复自签名',
+    sslCertSave: '保存证书',
+    sslCertPem: '证书内容 (.crt / .pem)',
+    sslKeyPem: '私钥内容 (.key)',
+    sslCertPemPlaceholder: '-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----',
+    sslKeyPemPlaceholder: '-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----',
+    sslCertSaved: '证书已保存，重启后生效',
+    sslCertCleared: '已恢复自签名证书，重启后生效',
    restartRequired: '需要重启',
    restartMessage: 'Web 服务器配置已保存，需要重启程序才能生效。',
    restarting: '正在重启...',
+    autoRestarting: '正在自动重启',
+    autoRestartingDesc: '配置已保存，服务恢复后将自动跳转到新地址...',
+    autoRestartingHttpsDesc: '服务即将重启，{sec} 秒后将显示跳转链接...',
+    autoRestartFailed: '自动重启超时，请手动刷新页面或检查服务状态。',
+    httpsManualRedirectTitle: '请点击下方链接前往新地址',
+    httpsManualRedirectDesc: 'HTTPS 自签名证书需要在浏览器中手动接受，点击链接后在安全警告页选择"继续访问"即可。',
    onlineUpgrade: '在线升级',
    onlineUpgradeDesc: '检查并升级 One-KVM',
    updateChannel: '升级通道',
@@ -557,7 +594,6 @@ export default {
    authSettingsDesc: '单用户访问与会话策略',
    allowMultipleSessions: '允许多个 Web 会话',
    allowMultipleSessionsDesc: '关闭后，新登录会踢掉旧会话。',
-    singleUserSessionNote: '系统固定为单用户模式，仅可配置会话并发方式。',
    // User management
    userManagement: '用户管理',
    userManagementDesc: '管理用户账号和权限',
@@ -817,27 +853,19 @@ export default {
    version: '版本',
    uptime: '运行时间',
    running: '运行中',
-    mode: '模式',
    format: '格式',
    resolution: '分辨率',
-    targetFps: '目标帧率',
-    fps: '实际帧率',
+    fps: '帧率',
    clients: '客户端',
    backend: '后端',
-    initialized: '已初始化',
-    yes: '是',
-    no: '否',
    mouse: '鼠标',
    mouseSupport: '鼠标支持',
    currentMode: '当前模式',
    absolute: '绝对定位',
    relative: '相对定位',
-    connection: '连接',
    channel: '通道',
    networkError: '网络错误',
    disconnected: '已断开',
-    availability: '可用性',
-    errorCode: '错误码',
    hidUnavailable: 'HID不可用',
    sampleRate: '采样率',
    channels: '声道',
@@ -889,6 +917,7 @@ export default {
      title: 'GOSTC 内网穿透',
      desc: '通过 GOSTC 实现内网穿透',
      addr: '服务器地址',
+      addrPlaceholder: '主机名或 IP（必填）',
      key: '客户端密钥',
      tls: '启用 TLS',
    },
@@ -915,9 +944,9 @@ export default {
      relayServerPlaceholder: 'hbbr.example.com:21117',
      relayServerHint: '中继服务器地址（端口可省略，默认 21117），留空则自动从 ID 服务器推导',
      relayKey: '中继密钥',
-      relayKeyPlaceholder: '输入中继服务器密钥',
-      relayKeySet: '••••••••',
-      relayKeyHint: '中继服务器认证密钥（如果服务器使用 -k 选项）',
+      relayKeyPlaceholder: '例如 pLU0pEj2IZnNVKzrIO1pIdwGA3dOVJJLkFIYGOCGH1E=',
+      relayKeySet: '已保存（32 字节 Base64，通常 44 字符；留空保存则保留）',
+      relayKeyHint: '与 hbbs/hbbr 的 -k 一致：标准 Base64，解码后固定 32 字节（一般为 44 个字符，含末尾 =）',
      deviceInfo: '设备信息',
      deviceId: '设备 ID',
      deviceIdHint: '此 ID 用于 RustDesk 客户端连接',