datalust / seq-tickets

Issues, design discussions and feature roadmap for the Seq log server
https://datalust.co/seq
96 stars 5 forks source link

Convenience plain-text alternative to `SEQ_FIRSTRUN_ADMINPASSWORDHASH` #2169

Closed nblumhardt closed 5 months ago

nblumhardt commented 5 months ago

The SEQ_FIRSTRUN_ADMINPASSWORDHASH is a secure way of specifying a default administrator password. It's a strong, salted, cryptographic hash, so including directly in scripts and configuration files is relatively safe.

But, creating the hash value is slightly more effort than simply specifying a default password, leading many to skip this step, start Seq in default open mode, and then set a password via the UI.

This latter flow is undesirable; we'll provide a plain text SEQ_FIRSTRUN_ADMINPASSWORD alternative environment variable that can be used as an easier option when there's no risk that the password will be exposed.

Initializing a new Seq instance using this setting will cause the admin account's "must change password" flag to be set, which is not the case when using the HASH variant.