2.9 KiB
id, title, sidebar_label
| id | title | sidebar_label |
|---|---|---|
| first-login | First login | First login |
A fresh install has no users and no organisation. The first visit creates both.
1. Bootstrap
Open the control plane in a browser. Because no user exists, you land on
/setup.
Fill in:
| Field | Notes |
|---|---|
| Organisation name | Display name. Shown throughout the UI |
| Slug | Lowercase, used in the hostname on cloud. Some names are reserved |
| Your name | |
| Becomes your sign-in identity | |
| Password | Stored bcrypt-hashed |
Submitting creates the organisation and its owner you.
:::warning Bootstrap works exactly once
The endpoint is open only while the database has no users. As soon as the first
one exists, /setup redirects to the login page and the bootstrap endpoint
refuses. There is no second chance to create the first owner, so record the
credentials before you close the tab.
:::
2. Sign in
You are taken to /login. Sign in with the email and password you just set.
Sessions are an opaque 32-byte token in the km_session cookie, with the body
held in Redis for 24 hours. Restarting Redis signs everyone out and loses
nothing else.
3. Look around
You land on the fleet dashboard, which is empty. The sidebar is the whole product:
| Section | What it does |
|---|---|
| Servers | The fleet enrol, inspect, console, update |
| Keys | SSH public keys and their assignments |
| Workflows | Compose and run scripted work |
| Steps | The reusable step library |
| Monitors | HTTP, TCP, ICMP and TLS checks |
| Secrets | The encrypted vault |
| Audit | Every mutating action |
| Settings | Members, SSO, alerts, retention, licence |
4. Add the rest of your team
Go to Settings → Access. Add members with a role:
| Role | Can |
|---|---|
owner |
Everything, including billing-adjacent settings |
admin |
Everything except owner-only settings |
member |
Day-to-day work servers, keys, workflows, monitors |
Settings and organisation management require owner or admin.
If you would rather not manage passwords, configure OIDC instead see Settings. OIDC is configured per organisation, and the client secret is stored encrypted.