Sign in to the console for the first time

The console is at https://portal.example.com/console. People who use desktops sign in at https://portal.example.com/portal instead.

There are two ways to get the first administrator account. The first is better, because no shared password ever exists.

Recommended: create your own account on the server

On the portal server, with the helper from Install the portal:

read -rs ADMIN_PASSWORD && export ADMIN_PASSWORD
sudo --preserve-env=ADMIN_PASSWORD billet-portal-task task admin:create -e production \
  username:you@example.com role:system_admin
unset ADMIN_PASSWORD

read -rs takes the password without showing it or saving it in your shell history. The command never takes a password on its command line, where other users of the server could see it.

Then sign in at /console with that user name and password.

Or: the first-run account

If the portal starts and finds no system administrator, it creates a temporary one and writes a warning to its log saying so. Its sign-in is:

User name:  default@billetstream.com
Password:   Changemeimmediately1!

These are published on purpose. The account can do one thing only, change its own password: every other request it makes is refused, and the console shows only the change-password page until you do. The deployment also reports itself unfinished until then.

1. Sign in at /console with the account above.
2. Set a new password.
3. Create your own system administrator (in the console, People, Add an operator, or with the command above), sign in as yourself, and delete the first-run account.

Once a system administrator exists, the first-run account is never created again.

If every administrator password is lost

Reset one on the server, which needs no browser:

read -rs ADMIN_PASSWORD && export ADMIN_PASSWORD
sudo --preserve-env=ADMIN_PASSWORD billet-portal-task task admin:passwd -e production \
  username:you@example.com
unset ADMIN_PASSWORD

Roles

Next

Create the certificate authority.