feat(setup): add a setup token for first-run setup (#3437)

deploy/helm/fluxer/templates/NOTES.txt

@@ -9,9 +9,13 @@ Open {{ $o }} once every pod is ready:
 
 The admin panel is at {{ $o }}{{ $v.adminBasePath }}.
 
-Register the first account and finish the setup wizard in the same sitting.
-Until the wizard is finished, any account that registers can change the
-instance configuration.
+The setup wizard asks for the setup token before it creates the admin account:
+
+  kubectl -n {{ .Release.Namespace }} get secret {{ include "fluxer.secretName" . }} -o jsonpath='{.data.FLUXER_SETUP_TOKEN}' | base64 -d
+
+A Secret with no FLUXER_SETUP_TOKEN has a token the API wrote to its log once:
+
+  kubectl -n {{ .Release.Namespace }} logs deployment/api | grep -i 'setup token'
 {{- if eq $v.edge.expose "loadBalancer" }}
 
 Point DNS for {{ $v.domain }} at the external address of the edge-public Service:

deploy/helm/fluxer/templates/_helpers.tpl

@@ -185,6 +185,7 @@ public: {{ substr 56 121 $der | b64enc | replace "+" "-" | replace "/" "_" | tri
 {{- else if and (hasPrefix "FLUXER_LIVEKIT_" $k) (eq (include "fluxer.livekitMode" $) "off") }}
 {{- else if and (eq $k "FLUXER_VALKEY_PASSWORD") (not $.Values.valkey.enabled) }}
 {{- else if and (eq $k "FLUXER_NATS_AUTH_TOKEN") (not $.Values.nats.enabled) }}
+{{- else if and (eq $k "FLUXER_SETUP_TOKEN") (or $.Values.secrets.existingSecret (and (not $.Values.secrets.generate) (not (include "fluxer.string" (get $.Values.secrets.values $k | default ""))))) }}
 {{- else }}
 {{- $keys = append $keys $k }}
 {{- end }}

deploy/helm/fluxer/templates/_validate.tpl

@@ -149,7 +149,7 @@
 {{- fail "FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 must be standard base64 of at least 32 bytes, for example the output of openssl rand -base64 32" }}
 {{- end }}
 {{- end }}
-{{- $long := list "FLUXER_SUDO_MODE_SECRET" "FLUXER_CONNECTION_INITIATION_SECRET" "FLUXER_PROFILE_PSEUDONYM_SECRET" "FLUXER_GATEWAY_RPC_AUTH_TOKEN" "FLUXER_ERLANG_COOKIE" "FLUXER_MEDIA_PROXY_SECRET_KEY" "FLUXER_ADMIN_SECRET_KEY_BASE" "FLUXER_ADMIN_OAUTH_CLIENT_SECRET" }}
+{{- $long := list "FLUXER_SUDO_MODE_SECRET" "FLUXER_CONNECTION_INITIATION_SECRET" "FLUXER_PROFILE_PSEUDONYM_SECRET" "FLUXER_GATEWAY_RPC_AUTH_TOKEN" "FLUXER_ERLANG_COOKIE" "FLUXER_MEDIA_PROXY_SECRET_KEY" "FLUXER_ADMIN_SECRET_KEY_BASE" "FLUXER_ADMIN_OAUTH_CLIENT_SECRET" "FLUXER_SETUP_TOKEN" }}
 {{- if ne (include "fluxer.livekitMode" .) "off" }}
 {{- $long = append $long "FLUXER_LIVEKIT_API_SECRET" }}
 {{- end }}

deploy/helm/fluxer/values.schema.json

@@ -397,6 +397,12 @@
                 "null"
               ]
             },
+            "FLUXER_SETUP_TOKEN": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "FLUXER_LIVEKIT_API_KEY": {
               "type": [
                 "string",

deploy/helm/fluxer/values.yaml

@@ -102,6 +102,10 @@ secrets:
     FLUXER_ADMIN_SECRET_KEY_BASE: ""
     # Client secret of the built-in admin OAuth application.
     FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ""
+    # Setup token the wizard asks for before the first admin account. With
+    # existingSecret, or with generate false and no value here, the API makes
+    # one on its first start and writes it to its log once.
+    FLUXER_SETUP_TOKEN: ""
     # LiveKit API key.
     FLUXER_LIVEKIT_API_KEY: fluxer
     # LiveKit API secret, at least 32 characters.