# REPORT — crafty-controller: seed a felhom-generated admin password (gokapi pattern)

**Date:** 2026-06-26 · **Repo:** `app-catalog-felhom.eu` (catalog-only) · **Commit:** `5a403d1`
**Guest:** 9201 (`demo-felhom`) on `felhom-pve` · **Controller:** v0.84.0 (unchanged — reuses its `initial_credentials` reader)

## Goal
Replace Crafty's auto-generated, ugly random admin password with a clean **felhom-generated** one,
using the same seeding pattern as gokapi (consistency), while keeping it visible on the app page.

## Root mechanism (discovered in Crafty source)
`main_models.default_settings` reads `app/config/default.json` on fresh install; the image ships
`config_original/default.json = {"username":"admin","password":"crafty"}` — 6 chars, below Crafty's
8-char minimum, so Crafty rejected it and generated a random password into `default-creds.txt`. We can't
"lengthen" that internal fallback — we **seed** a valid `default.json` instead.

## Change (catalog-only)
- **`docker-compose.yml`**: new `CRAFTY_PASSWORD` env + an **entrypoint** wrapper that overwrites
  `config_original/default.json` with `{"username":"admin","password":"$CRAFTY_PASSWORD"}` before exec'ing
  the image launcher (`/crafty/docker_launcher.sh -d -i`). On fresh install the launcher copies our
  template into the config volume → Crafty creates `admin` with our password.
- **`.felhom.yml`**: new `CRAFTY_PASSWORD` deploy field (`type: password`, `generate: password:24`,
  `locked_after_deploy` — mirrors gokapi's `GOKAPI_PASSWORD`, alphanumeric so JSON/shell-safe). Repointed
  `initial_credentials.file` `default-creds.txt` → `default.json` so the controller's "Kezdeti belépési
  adatok" card shows the **seeded** password.
- No controller change: the deploy flow already injects/decrypts password deploy-fields into the compose
  env (`stackEnv`), and v0.84.0's `initial_credentials` reader already parses `default.json`.

## Live validation (guest 9201 — fresh install via the real pipeline)
Removed crafty + wiped its volumes, then deployed via `POST /api/stacks/crafty-controller/deploy` with
`{DOMAIN, SUBDOMAIN, CRAFTY_PASSWORD}` (clean 24-char alphanumeric).

| Check | Result |
|---|---|
| Fresh install, **no "Default password too short"** | ✅ Crafty used our seeded password |
| `default.json` in volume | `{"username":"admin","password":"<seeded>"}` |
| **Crafty API login** `admin`/seeded | **HTTP 200 + token** (gold standard) |
| Stray `default-creds.txt` random pw | **401 rejected** — non-functional artifact (see note) |
| `app.yaml` | `CRAFTY_PASSWORD: ENC:…` (encrypted at rest) + in `locked_fields` |
| App-page card | shows the seeded password (from `default.json`) |
| Public URL `minecraft.demo-felhom.eu` | **302** |

## Known quirk (documented, low-risk)
Crafty still writes `default-creds.txt` with a *different* random password during init even though it
used our `default.json`. That password is **non-functional** (login → 401) and the file is **not** shown
anywhere in the felhom UI (the card reads `default.json`; FileBrowser is scoped to userdata, not
`/crafty/app/config`). Left as-is — a post-boot cleanup would be a racy entrypoint hack for an invisible
file. The canonical, working password is the seeded one shown on the app page.

## Consistency
crafty now matches gokapi: a felhom-generated, locked, `password`-type deploy field set at deploy time —
plus the app-page card (v0.84.0 reader) so the initial login is also visible there.