Allow only authorised user to fill out setup wizard

[hardillb]

Epic

#1942

Description

As a: FlowForge Admin

I want to: be able to securely deploy FF publicly

So that: nobody can use the setup wizard before me to create the first admin user

Which customers would this be availble to

All Users, (CE)

Acceptance Criteria

• Setup Wizard protected

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

[hardillb]

I suggest a flag (cmd line, in the flowforge.yml, or both) that will generate a random password on startup, log this and require it to be entered to complete the setup wizard.

[hardillb]

This is a requirement for AWS container based applications.

[ZJvandeWeg]

@hardillb why not create an admin user instead, with a generated password they're forced to update after signing in? I think we have the plumbing for password expiry already.

[hardillb]

That might work. I will have to work out what that will do to the setup wizard

[hardillb]

OK, I have this working.

If create_admin: true is added to the etc/flowforge.yml then the setup wizard will create a user with the following details:

• username: admin
• name: Default Admin
• email: admin@example.com

And a random 8 char password. The password will be printed to the logs as follows:

[2023-07-10T09:58:42.277Z] INFO: [SETUP] Created default Admin User
[2023-07-10T09:58:42.277Z] INFO: [SETUP] username: admin
[2023-07-10T09:58:42.277Z] INFO: [SETUP] password DoVRk0OW

The user will be prompted to change the password after the wizard completes when they try and log in for the first time, the wizard will still ask for license and telemetry.

We will need to add an entry in the docs to explain how to change the email address and name.