Deploy

The first account

A new server can only be claimed with the setup code it prints, so nobody else on your network can get there first.

Find the setup code

deploy/lxc.sh prints it at the end. Again any time:

cat /var/lib/cermm/setup-code.txt
journalctl -u cermm | grep -A2 'setup code'

Running from a checkout (npm run server), it's in the server's output and in data/setup-code.txt.

Claim it

1. Open https://<server>:4800. The browser warns about the certificate the first time; see HTTPS to check its fingerprint and trust it.
2. Enter the setup code, your name, a username and a password.
3. You're signed in as the first admin, with every privilege.

Then

• Turn on two-factor sign-in: Settings → Security. Any authenticator app works (TOTP). Keep the ten recovery codes somewhere safe. The Settings row has an amber dot while it's off.
• Invite people from Settings → Users: each gets a one-time link to choose their own password. See Users and two-factor.
• Once you have two-factor yourself, you can require it for everyone.

Sign-in rules

• Ten wrong passwords or codes from one address means a 15-minute wait. A wrong username takes as long as a wrong password and says the same thing.
• A sign-in lasts 30 days, or ends after two weeks unused.
• Running commands asks for your password again after 10 minutes.

Locked out? See Locked out.