root/MarketingTool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

clarify mandatory admin bootstrap
CI / compose (push) Failing after 10m9s
Details

Browse Source
This commit is contained in:
Marco0300
2026-09-03 16:24:53 +02:00
parent d33940e37f
commit 0478228c08
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -74,7 +74,7 @@ curl -fsS http://localhost:8080/healthz
docker compose down
```
Compose passes the optional `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` values to the API. Set both in an untracked `.env` only when provisioning a fresh instance, then remove them and rotate the password after the bootstrap admin is created. No credentials belong in this repository.
Compose passes the one-time `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` values to the API. **Set both before the first startup to create the initial administrator**; if both are blank, no login account is created. Use them only for a fresh instance, then remove them and rotate the password after the bootstrap admin is created. No credentials belong in this repository.
Authenticated browser requests use a server-side session cookie; login creates a session and logout invalidates it. The liveness endpoints (`GET /api/v1/health/live` and `GET /healthz`) intentionally remain unauthenticated so Docker, ingress, and monitoring health checks can use them. Authentication is not a substitute for tenant/authorization checks: protected routes must enforce the session and organization boundary server-side.