First run

A new install migrates its schema and starts with no sign-in providers. You get in as the built-in administrator, admin.

The first password

There is no published default.

Install	Where the first password comes from
Helm chart	Generated into the release Secret (BOOTSTRAP_ADMIN_PASSWORD)
One-box bundle	Generated by install.sh and printed once
Anything else	BOOTSTRAP_ADMIN_PASSWORD if set; otherwise generated and printed once in the log at first boot

BOOTSTRAP_ADMIN_PASSWORD is read only when the account has no password at all; it never resets one. Lost it? Run toft local-admin enable on the host — see The built-in administrator.

The first password is must-change: signing in with it creates no session and only lets you replace it. Replacing it signs you in.

Note

No first-user-becomes-admin rule. The first person through a new provider gets that provider’s default_role. Administrators are appointed by an administrator.

The order to do things in

1. Sign in as admin and set a real password.
2. Open Admin → System checks to see what this install can and cannot do (checks).
3. Add a sign-in provider and confirm somebody can sign in through it.
4. Make one of those people an administrator — before you rely on SSO.
5. Turn on only the optional capabilities you will use.
6. Decide whether apps may be public, and whether every app is listable to everyone signed in.
7. Adjust the operating dials if the defaults do not fit your machine.
8. Configure email so people get notified.

Do step 4

An install with SSO and no administrator behind it works until the day it does not. Keep the admin password where your team keeps break-glass credentials, and do not switch local sign-in off with only one administrator — the Lockout risk check warns when you have.