First start

The instance is up and the login page is open. What happens next decides who owns it. The account on this page is the one you sign in with: the instance’s own. The first bank account, a passbook or a PEA, is a later and unrelated gesture: Your first account.

The first account becomes the administrator

There is no setup wizard and no default account. The very first real account created on a fresh instance is given the role admin; every account created after it is an ordinary user. Nothing on the sign-up form says so, and the role is not offered as a choice. Whoever registers first owns the instance.

The demonstration account does not count. It is created with isDemo set and carries the role user, so an instance seeded with the demo still hands administration to the first real person who signs up.

That is the only place the role is handed out. No screen grants it afterwards, so a second administrator is made by writing role = 'admin' on that account’s row against the database by hand. Managing users is what the first one gets.

1. On the login page, follow Create an account. Email, username and a password of at least twelve characters; the rule is written under the field, and a password that is long but guessable is refused with a reason rather than accepted.

2. You are signed in, and you are the administrator. Settings → Administration is now drawn in your settings, and only in yours.

3. Close sign-ups there, unless the instance is meant to take more people. The switch is not the .env variable, and Open registration says which of the two wins.

4. Decide about the demonstration account on the same screen. It is off unless DEMO_SEED_ENABLED=true was set before the first start.

If you registered second

An ordinary user cannot promote themselves, and the Administration tab is not drawn for them. Nothing in the interface grants the role: it is given once, at the first registration, and the only thing that ever hands it out again is an instance starting with no administrator at all. Managing users has that case, and what making a second administrator really takes.

Forgotten password, with no mail server

Badlen sends no email. A reset request writes the link to the application log instead, valid one hour, and an administrator with server access reads it:

docker compose logs app | grep "reset link"

The link is built from PUBLIC_URL, so a stale value there sends you to an address that answers nothing.

Next: Behind a proxy if the instance is to be reached from outside the machine.