First Boot

First Boot and administrator enrollment

Outcome: Finish the one-time LexiOS enrollment without exposing an unclaimed Panel on an untrusted network.

What appears after selecting a kernel

1. From the USB boot menu select 1 LexiKernel or 2 LexiOS on Linux 7.4. The Linux entry in the current image is 7.4-rc2.
2. The first boot expands the LEXIDATA data partition and filesystem to fill the stick (verified for both kernels).
3. Read the local status console. It reports the signing/Secure Boot state, setup state and Panel address. In the USB appliance the Panel listens on port 8090; the actual network address is displayed locally. Do not guess an address.
4. Use another browser on the trusted local network to open that displayed address. Before enrollment, the browser shows a standalone First-boot setup page with the Secure enrollment form, not the normal authenticated dashboard.

Create the administrator

1. Review the hardware security summary above the form, including any critical or unknown status; stop to investigate unexplained failures.
2. If the form displays Temporary setup password or console code, read the code only from the physical device console/installer and enter it. The optional code unlocks this form only; it is not meant for reuse.
3. Enter Root password (12+ characters) and Confirm root password.
4. Review Administrator username (the installed default is supplied in the form), choose Administrator password (12+ characters; uppercase, lowercase, digit), and confirm it.
5. Optionally set LexiOS hostname (optional) according to your local naming policy.
6. Select Complete first-boot setup. Do not interrupt a credential or network write. After enrollment, sign in as the administrator and review Access, System, Network and Models in the Panel.

Critical difference between desired and current behavior

The setup-code field is conditional, not universal. In the supplied Panel's first-boot implementation, code_required is an owner opt-in setting; by default no code field appears. Thus an unconfigured Panel on a reachable network is exposed to first-visitor administrator creation. The local six-word code is required only when that feature is explicitly enabled. Complete first boot immediately on a trusted and isolated network. A mandatory console-code default is a known unfinished security improvement.

If a setup code is configured but missing, do not try random credentials or bypass the gate. Obtain the console-provided credential locally or return to the installation operator; the one-time enrollment flow is deliberately privileged.

After enrollment

• Open Models, add an appropriately verified model and configure it under Instances.
• Use Network and Access to review users, permissions, token scopes, firewall and network exposure. An admin-only terminal and password vault are documented in Files, Terminal and Passwords.
• Inspect Diagnostics when the Console or Panel reports errors. The debug kit records failed UI requests but does not intentionally collect credentials.
• When the kernel reports that storage usage or CPU usage cannot be measured under LexiKernel, do not interpret empty metrics as zero utilization; see Kernels.

Enrollment form reference

Control (label as shown)	What it does / consequence
Temporary setup password or console code (conditional)	Proves local enrollment access when the opt-in code requirement is enabled; absent by default.
Root password (12+ characters)	Sets the privileged system credential used for major system work.
Confirm root password	Must match the root password; prevents an accidental unrepeatable value.
Administrator username	Names the first Panel administrator.
Administrator password (12+ characters; uppercase, lowercase, digit)	Sets the initial administrator login credential.
Confirm administrator password	Must match the administrator password.
LexiOS hostname (optional)	Sets an optional local machine label; it is not a network address to enter in the browser.
Complete first-boot setup	Submits a privileged, one-time enrollment; do not allow an untrusted visitor to reach this page first.

If the page does not appear, the network fails or setup does not complete, follow Troubleshooting. See also Secure Boot and Security.