app-catalog-felhom.eu/FIRST-ADMIN.md

FIRST-ADMIN — how each app gets its first admin account (the audit behind 09 §3 decision 45)

The rule (operator, 2026-09-28): an app is never published with a login a stranger knows. The box publishes every app on the household's domain (*.domain through the tunnel). Where the box can set the first admin password, it generates one at install and shows it on the app page. Where it cannot, the app stays in the catalog, and the install dialog and the app page say what the default login is and to change it at once.

Mechanisms (controller ≥ 0.279.0; the gate ≥ 0.280.0):

• after_install: in .felhom.yml — one command in the app's own container after a FRESH install, with generated deploy values filled in; success: marker required. Never after a restore or a kept-data load. (internal/stacks/after_install.go)
• The page's default-login rule — app_info.default_creds is shown, with the sentence „Ez az alkalmazás egy ismert, közös jelszóval indul: %s. Telepítés után azonnal változtasd meg." / "This app starts with a known, shared password: %s. Change it right after the install.", while that login is in effect; hidden once after_install replaced it. (internal/web/known_login.go)
• The setup gate (09 §3 decision 46, controller ≥ 0.280.0) — setup_gate: true (+ optional setup_done_probe:): a fresh install of an open-first-run app is closed to everyone but the household until the app's own status says an admin exists, or the household presses „Kész, beállítottam". Spike and verdict: felhom.eu/documentation/audits/login-gate-2026-09-29/B/B-VERDICT.md (14 of 34 class-4 apps have a probe — 2 measured, 12 upstream; 20 need the button). It does not close OPEN SIGN-UP after the setup (R-711).
• „Megváltoztattam" / "I changed it" (controller ≥ 0.280.0, R-710) — the household's word under a known default login.

Classes: 1 generated by us at install · 2 set by the household in our dialog · 3 a hard-coded default · 4 an open first-run screen (the first visitor creates the admin) · 5 no login by design · 6 unknown. Sources: M = measured on a box (named) · R = read in this catalog · U = upstream, read or remembered, NOT measured. Every U must be measured before a fix is built on it.

Status 2026-09-29: 5 fixed by a generated first password (bookstack, calibre-web, claper, mealie, wger — every class-3 app); 4 class-4 apps gated (immich, n8n, audiobookshelf, uptime-kuma). 30 class-4 apps remain open — the next sessions gate them app by app (R-707): a probe measured on 9202 where the app has one, the button where it has none. Until an app is gated, its risk is the window until the household opens it first.

app	class	how the first admin exists	fix route	status	source
actualbudget	4	first visitor sets the server password	(b) POST /account/bootstrap	open	R, harness fixture
adventurelog	4	open sign-up	(a) DJANGO_ADMIN_* env; (b) createsuperuser --noinput	open	R; U (env)
audiobookshelf	4	first visitor creates root	setup gate, probe GET /status → isInit	GATED — catalog, 2026-09-29	M 9202: as immich (the probe, read from upstream, measured: opened ~20 s after POST /init); its app's login 200 after
bentopdf	5	browser-only PDF tool, no accounts	–	fine	R
bookstack	3	admin@admin.com / password	(b) artisan bookstack:create-admin --initial	FIXED — catalog, decision 45	M 9202: default fails, generated works; M demo-hp: default still works on the installed app (unchanged, page warns)
calcom	4	first visitor becomes admin (/api/auth/setup)	(b) POST /api/auth/setup; (a) NEXT_PUBLIC_DISABLE_SIGNUP	open	M 9202 (setup 200 once, then 400)
calibre-web	3	admin / admin123	(b) cps.py -p /config/app.db -s admin:<pw> as abc; generate: password:24:special (controller ≥ 0.280.0)	FIXED — catalog, 2026-09-29	M 9202: fresh install — default refused, generated signs in (302), wrong refused; M demo-hp: the installed app's password changed by the operator's ruling (Part A)
claper	3 (+ open sign-up)	seeds admin@claper.co / claper	(b) bin/claper rpc … update_user_password	FIXED — catalog, decision 45	M 9202: default fails, generated works, a restore keeps it
code-server	1	PASSWORD generated, applied every start	–	fine	R
crafty-controller	1	CRAFTY_PASSWORD → default.json	–	fine	R
docmost	4	first registered user is admin	(b) POST /api/auth/setup	open	R, fixture
emby	4	setup wizard	(b) /Startup/* API	open	U
ghost	4	/ghost/ setup	(b) POST /ghost/api/admin/authentication/setup/	open	U
gitea	4	web installer open (no INSTALL_LOCK)	(a) INSTALL_LOCK + (b) gitea admin user create	open	R; R-624
glance	5	config-file dashboard, no users	–	fine	R
gokapi	1	GOKAPI_PASSWORD before first serve	–	fine	R
grafana	1	GF_SECURITY_ADMIN_PASSWORD — falls back to admin if empty (R-708)	–	fine while the field is set	R
gramps-web	4	first-run onboarding	(b) python3 -m gramps_webapi user add	open	U
home-assistant	4	onboarding	(b) POST /api/onboarding/users	open	R, fixture
homebox	4	open registration	(b) register API; (a) disable registration after	open	U
homepage	5	static start page	–	fine	R
immich	4	first visitor admin sign-up	setup gate, probe GET /api/server/config → isInitialized	GATED — catalog, 2026-09-29 (decision 46)	M 9202: stranger 302→gate page / 401 during and after the install; household in 0.2 s; probe opened it 0–20 s after the sign-up; phone-app API (Bearer) 200 after (felhom.eu/documentation/audits/login-gate-2026-09-29/C/)
jellyfin	4	startup wizard	(b) /Startup/*	open	U
kimai	1	ADMIN_PASSWORD → ADMINPASS	–	fine	R
komga	4	first visitor claims	(b) POST /api/v1/claim	open	U
mealie	3	changeme@example.com / MyPassword	(b) its own user repository (update_password), password as sys.argv[1]	FIXED — catalog, 2026-09-29	M 9202: fresh install — default 401, generated 200, wrong 401 (felhom.eu/documentation/audits/login-gate-2026-09-29/D/)
n8n	4	owner setup	setup gate, probe GET /rest/settings → data.userManagement.showSetupOnFirstLoad = false	GATED — catalog, 2026-09-29	M 9202: as immich; opened by the probe ~20 s after the owner setup
navidrome	4	first user is admin	(a) ND_DEVAUTOCREATEADMINPASSWORD; (b) /auth/createAdmin	open	R, fixture; U (env)
nextcloud	1	NEXTCLOUD_ADMIN_PASSWORD → auto-install	–	fine	R; M demo-hp 2026-09-28
onlyoffice	5	JWT-protected API, no login screen	–	fine	R
opengist	4	first registered user is admin	(b) POST /register; (a) OG_DISABLE_SIGNUP	open	R, fixture
outline	4	e-mail / magic-link onboarding	(c) none found (R-624)	open — page note needed	R
paperless-ngx	1	PAPERLESS_ADMIN_PASSWORD	–	fine	R
papra	4	open e-mail sign-up	(b) sign-up API; (a) disable registration	open	R, fixture
plant-it	4	open, USERS_LIMIT=-1	(a) USERS_LIMIT=1 + (b) sign-up	open	U
plex	2	the household's plex.tv claim token	–	fine	R
privatebin	5	anonymous pastes by design	–	fine	R
radarr	4	first visitor sets auth	(b) PUT /api/v3/config/host with the apikey	open	U
rallly	4	magic link to any e-mail	(a) INITIAL_ADMIN_EMAIL + ALLOWED_EMAILS	open	U
recipe-importer	4	our own image, open until set	(c) now; our own code	open	R
romm	4 (catalog said 3)	first unauthenticated POST /api/users creates the user (harness); the stale admin / admin note is removed (2026-09-29)	(b) POST /api/users; or the setup gate	open	M demo-hp (401 for the old note); fixture
seerr	4	setup wizard (needs a media server)	(c)	open	U
sonarr	4	as radarr	(b)	open	U
sparkyfitness	4	open registration	(a) SPARKY_FITNESS_ADMIN_EMAIL + disable sign-up	open	U
tandoor	4	setup page while no users	(b) createsuperuser --noinput	open	R, fixture
termix	4	first registered user is admin	(b) user-create API	open	U
uptime-kuma	4	first visitor creates admin (socket.io setup)	setup gate, no HTTP probe → the household's „Kész, beállítottam"	GATED — catalog, 2026-09-29	M 9202: gate held across a controller restart; the press opened it (second press 409). The proof pressed WITHOUT doing the socket.io setup — the press trusts the household
vaultwarden	1	ADMIN_TOKEN generated; invite-only (R-512)	–	fine	R
vikunja	4	open registration	(b) vikunja user create; (a) disable registration	open	R, fixture
wanderer	4	PUBLIC_DISABLE_SIGNUP=false	(a) disable after first user	open	U
wger	3	admin / adminadmin	(b) Django set_password, password as sys.argv[1]	FIXED — catalog, 2026-09-29; + R-712 (a browser's https Origin was refused by CSRF)	M 9202: fresh install — default refused, generated signs in (302), wrong refused, with the browser's https Origin
wishlist	4	first sign-up is admin	(b) POST /signup	open	R, fixture
zipline	4 (catalog said 3)	v4 sets up on first run; the stale admin / zipline note is removed (2026-09-29)	(b) setup API (U); or the setup gate (probe /api/setup firstSetup, U)	open	R; audit logs

Counts (computed from the table, 2026-09-29): class 1: 8 · class 2: 1 · class 3: 5 · class 4: 34 · class 5: 5. Fixed: 5 (every class-3 app). Gated: 4. Open: 30 (class 4). Fine: 14.