docs(adr): first-admin bootstrap strategy across environments (ADR 0001)#28
Closed
jlc488 wants to merge 1 commit into
Closed
docs(adr): first-admin bootstrap strategy across environments (ADR 0001)#28jlc488 wants to merge 1 commit into
jlc488 wants to merge 1 commit into
Conversation
Design-only PR — no code yet. Captures the decision for how a fresh devslab-kit deployment gets its first administrator, so the dashboard is usable, without leaving a permanent backdoor as the same artifact moves local-dev → staging → production. Key decisions: - Bootstrap is property-driven (devslab.kit.bootstrap.*), OFF by default → a no-config prod deploy provisions nothing. - No fixed default password: blank admin-password generates a random one logged exactly once (GitLab/Jenkins pattern). A literal admin/admin only appears if the operator writes it (i.e. local dev). - Forced password change on first login via a must_change_password flag + a self-service change-password endpoint; the dashboard guards every route until rotation. - Profiles stay the consumer's mechanism for toggling the properties, never the kit's trigger — with per-environment config snippets for local / staging / prod. - Idempotent runner + optional prod safety pin (fail-on-default-password-in-prod). - Forward-looking: leaves room for a future first-run setup wizard (GET /bootstrap/status) for interactive installs. Bilingual (en + ko), mirroring the README convention. Includes a 5-PR implementation plan and the alternatives considered. Status: Proposed — awaiting sign-off before implementation.
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Design-only PR — no code yet. Opening this for sign-off before I implement.
This answers the question: how does a fresh
devslab-kitdeployment get its first administrator (so the dashboard is usable at all), without leaving a permanent backdoor, as the same jar moves local-dev → staging → production?The decision in one paragraph
Bootstrap is property-driven and OFF by default (
devslab.kit.bootstrap.enabled=false), so a no-config production deploy provisions nothing. When enabled, a blank password generates a random one logged exactly once (GitLab/Jenkins pattern) — a literaladmin/adminonly exists if the operator writes it, which is what a local profile does and a production config must not. The first admin is flagged must-change-password, so the dashboard forces rotation on first login before any other route is reachable. Profiles stay the consumer's mechanism for toggling these properties, never the kit's trigger.Why not just
@Profile("dev")local/dev/development— inconsistent).admin/adminbackdoor.Covered in the ADR
fail-on-default-password-in-prodsafety pin.mustChangePasswordguard now, and a forward-looking note on a future first-run setup wizard (GET /bootstrap/status) for interactive installs.Bilingual — English · 한국어, mirroring the README convention.
What I need from you
Sign-off (or edits) on:
Once you're happy I'll flip Status: Proposed → Accepted and start PR 1.