feat(setup): add a setup token for first-run setup (#3437)

deploy/helm/fluxer/templates/NOTES.txt

@@ -9,9 +9,13 @@ Open {{ $o }} once every pod is ready:
 
 The admin panel is at {{ $o }}{{ $v.adminBasePath }}.
 
-Register the first account and finish the setup wizard in the same sitting.
-Until the wizard is finished, any account that registers can change the
-instance configuration.
+The setup wizard asks for the setup token before it creates the admin account:
+
+  kubectl -n {{ .Release.Namespace }} get secret {{ include "fluxer.secretName" . }} -o jsonpath='{.data.FLUXER_SETUP_TOKEN}' | base64 -d
+
+A Secret with no FLUXER_SETUP_TOKEN has a token the API wrote to its log once:
+
+  kubectl -n {{ .Release.Namespace }} logs deployment/api | grep -i 'setup token'
 {{- if eq $v.edge.expose "loadBalancer" }}
 
 Point DNS for {{ $v.domain }} at the external address of the edge-public Service:

deploy/helm/fluxer/templates/_helpers.tpl

@@ -185,6 +185,7 @@ public: {{ substr 56 121 $der | b64enc | replace "+" "-" | replace "/" "_" | tri
 {{- else if and (hasPrefix "FLUXER_LIVEKIT_" $k) (eq (include "fluxer.livekitMode" $) "off") }}
 {{- else if and (eq $k "FLUXER_VALKEY_PASSWORD") (not $.Values.valkey.enabled) }}
 {{- else if and (eq $k "FLUXER_NATS_AUTH_TOKEN") (not $.Values.nats.enabled) }}
+{{- else if and (eq $k "FLUXER_SETUP_TOKEN") (or $.Values.secrets.existingSecret (and (not $.Values.secrets.generate) (not (include "fluxer.string" (get $.Values.secrets.values $k | default ""))))) }}
 {{- else }}
 {{- $keys = append $keys $k }}
 {{- end }}

deploy/helm/fluxer/templates/_validate.tpl

@@ -149,7 +149,7 @@
 {{- fail "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 must be standard base64 of at least 32 bytes, for example the output of openssl rand -base64 32" }}
 {{- end }}
 {{- end }}
-{{- $long := list "FLUXER_SUDO_MODE_SECRET" "FLUXER_CONNECTION_INITIATION_SECRET" "FLUXER_PROFILE_PSEUDONYM_SECRET" "FLUXER_GATEWAY_RPC_AUTH_TOKEN" "FLUXER_ERLANG_COOKIE" "FLUXER_MEDIA_PROXY_SECRET_KEY" "FLUXER_ADMIN_SECRET_KEY_BASE" "FLUXER_ADMIN_OAUTH_CLIENT_SECRET" }}
+{{- $long := list "FLUXER_SUDO_MODE_SECRET" "FLUXER_CONNECTION_INITIATION_SECRET" "FLUXER_PROFILE_PSEUDONYM_SECRET" "FLUXER_GATEWAY_RPC_AUTH_TOKEN" "FLUXER_ERLANG_COOKIE" "FLUXER_MEDIA_PROXY_SECRET_KEY" "FLUXER_ADMIN_SECRET_KEY_BASE" "FLUXER_ADMIN_OAUTH_CLIENT_SECRET" "FLUXER_SETUP_TOKEN" }}
 {{- if ne (include "fluxer.livekitMode" .) "off" }}
 {{- $long = append $long "FLUXER_LIVEKIT_API_SECRET" }}
 {{- end }}

deploy/helm/fluxer/values.schema.json

@@ -397,6 +397,12 @@
                 "null"
               ]
             },
+            "FLUXER_SETUP_TOKEN": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "FLUXER_LIVEKIT_API_KEY": {
               "type": [
                 "string",

deploy/helm/fluxer/values.yaml

@@ -102,6 +102,10 @@ secrets:
     FLUXER_ADMIN_SECRET_KEY_BASE: ""
     # Client secret of the built-in admin OAuth application.
     FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ""
+    # Setup token the wizard asks for before the first admin account. With
+    # existingSecret, or with generate false and no value here, the API makes
+    # one on its first start and writes it to its log once.
+    FLUXER_SETUP_TOKEN: ""
     # LiveKit API key.
     FLUXER_LIVEKIT_API_KEY: fluxer
     # LiveKit API secret, at least 32 characters.

deploy/self-hosting/.env.example

@@ -344,6 +344,8 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_APP_STATUS_PAGE_URL=
 #FLUXER_APP_STATUS_PAGE_INCIDENT_HISTORY_URL=
 #FLUXER_INSTANCE_SETUP_CONFIGURED=false
+# Setup token the wizard asks for before the first admin account. 32 to 256 characters. Unset means the API generates one on the first start and writes it to its log once.
+#FLUXER_SETUP_TOKEN=
 # How members sign in on a new instance, username or email. Unset means username. Read only on the first start.
 #FLUXER_ACCOUNT_IDENTITY=
 # Username tags on a new email instance. none gives unique names with no tag, random gives name#4821. Unset means none. A username instance always uses none. Read only on the first start.
@@ -536,7 +538,7 @@ FLUXER_DISCOVERY_ENABLED=true
 
 # The bundled Valkey holds durable state as well as cache, so it runs with an
 # append-only file and with noeviction, which fails an over-limit write instead
-# of dropping queued work. Change the policy only if that state lives elsewhere.
+# of dropping queued work. Change the policy only if that state is kept elsewhere.
 #FLUXER_VALKEY_MAXMEMORY=192mb
 #FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction
 #FLUXER_VALKEY_APPENDFSYNC=everysec

deploy/self-hosting/docker-compose.yml

@@ -466,6 +466,7 @@ services:
     environment:
       <<: *fluxer-env
       FLUXER_API_PORT: "8080"
+      FLUXER_SETUP_TOKEN: ${FLUXER_SETUP_TOKEN:-}
       NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}${FLUXER_API_NODE_OPTIONS:+ $FLUXER_API_NODE_OPTIONS}
       NODE_EXTRA_CA_CERTS: ${FLUXER_NODE_EXTRA_CA_CERTS:-/etc/ssl/certs/ca-certificates.crt}
       FLUXER_POSTGRES_MAX_CONNECTIONS: "${FLUXER_API_POSTGRES_MAX_CONNECTIONS:-25}"