38 Releases 38 Tags

RSS Feed

• v2026.05.08.4 626fc7502c

  Compare

  v2026.05.08.4 Stable

  bvandeusen released this 2026-05-08 22:20:03 -04:00 | 976 commits to main since this release

  Removes the bootstrap-admin path. Self-registration is now the only way to create the first admin on a fresh deploy.

  What changed

  • internal/auth/bootstrap.go and its test — gone
  • auth.Bootstrap() startup call removed from cmd/minstrel/main.go
  • AuthConfig + AdminBootstrapConfig structs removed from internal/config
  • MINSTREL_AUTH_ADMIN_USERNAME / MINSTREL_AUTH_ADMIN_PASSWORD env vars no longer read
  • auth: block removed from config.example.yaml
  • Bootstrap-related comments removed from docker-compose.yml
  • README quickstart now points at /register instead of "watch logs for password"

  Net diff: +1 / -303 across 8 files.

  New first-run flow

  1. docker compose up
  2. Visit http://<host>/register
  3. First user on an empty users table becomes admin automatically (existing CreateUserFirstAdminRace path — now the only path)

  Operator notes

  • Existing instances that already have a bootstrap admin in the DB: the row sticks around (no migration), and the admin still works. To get rid of it, register a new admin via /register (will need an invite token, since users is non-empty), promote them in /admin/users, then delete the bootstrap account.
  • Fresh instances (including the prod instance reset for this release): just visit /register.
  • Default registration mode stays invite_only after user #1 — generate invite tokens from /admin/users for additional users. UI for switching to open registration is a small follow-up task.
  • Recovery story: forgotten admin password on a single-admin instance now requires Fable #321 (CLI password reset, not yet shipped). Worth scheduling soon. The bootstrap path didn't help here either — it only fired on empty users.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)