From 0fbf379ae9c8f7804d0be0f8c99e5c666a3186a5 Mon Sep 17 00:00:00 2001 From: boban Date: Thu, 2 Jul 2026 20:20:32 +0200 Subject: [PATCH] docs(readme): match the installer + auth changes (no domain prompt, random install password, web terminal) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Quick start: the installer no longer asks for a domain — it installs over IP/HTTP and prompts only for the HTTP port + admin email; a domain (auto-HTTPS) is set later in the dashboard. - The first admin now gets a RANDOM one-time password (shown once in the summary), not the literal 'clusev'; rotation is recommended (a warning banner nudges) but no longer forced. - add the web terminal to Features (per-server + Clusev-host SSH, host-key pinned); mention the first-run guided tour; point the domain/TLS section at the dashboard. Co-Authored-By: Claude Opus 4.8 --- README.md | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 96b9a1b..9b81d4c 100644 --- a/README.md +++ b/README.md @@ -46,6 +46,7 @@ reimplements their daemons; it orchestrates the real ones. | **Dashboard & live metrics** | CPU, memory, load and disk per server, streamed in real time over WebSockets. | | **systemd services** | List, start / stop / restart, and tail the live journal — per service, per server. | | **SFTP file manager** | Browse the remote filesystem, edit text files in place, preview images. | +| **Web terminal** | A full SSH terminal in the browser — one per server, and one for the Clusev host itself. Real PTY with tab-completion; the connection's host key is pinned against MITM. | | **Server details & hardening** | Resource gauges, volumes, interfaces and SSH keys; UFW / firewalld rules and fail2ban status with one-click controls; a guided _"generate an SSH key and disable password login, safely"_ flow. | | **Security** | Pluggable 2FA (TOTP and/or hardware keys, or off), one-time backup codes, an encrypted SSH-credential vault, and a complete tamper-evident audit log. | | **Multiple administrators** | Add further admin accounts — every action is attributed in the audit log; view and revoke active sessions per device, per user, or globally. | @@ -97,26 +98,28 @@ The installer is **idempotent** (safe to re-run) and, in one pass: 1. Installs **Docker** (Debian/Ubuntu, from Docker's official repository) if it isn't already present. 2. Creates a dedicated **`clusev`** system user — in the `docker` group, owning and running the stack — with a random password. -3. Asks for a **domain** (leave empty for IP access) and an **admin e-mail** (default - **`admin@clusev.local`**), or reads `CLUSEV_DOMAIN` / `CLUSEV_ADMIN_EMAIL` from the environment for - an unattended install. With a domain it checks whether DNS already points here: if so a certificate - is obtained automatically; if not, it warns you and lets you take the domain anyway (HTTP until DNS - is correct) or continue on the IP. +3. Installs over the server's **IP address (plain HTTP)** — no domain is asked for. Prompts only for + the **HTTP port** (default 80) and an **admin e-mail** (default **`admin@clusev.local`**), or reads + `CLUSEV_ADMIN_EMAIL` / an optional `CLUSEV_DOMAIN` from the environment for an unattended install. A + domain with automatic HTTPS is set later in the dashboard — see [Access, domain & TLS](#access-domain--tls). 4. Generates all secrets (once — never regenerated on re-run), builds the image, starts the stack, - runs the migrations, and creates the first administrator with the **default password `clusev`** - (you are forced to change it on first login). + runs the migrations, and creates the first administrator with a **random one-time password** printed + in the closing summary. 5. Installs a themed host login banner (MOTD) showing the dashboard address and live stack status. When it finishes, the terminal prints a single summary: the **dashboard URL**, the **admin login** -(your e-mail — `admin@clusev.local` if you left it empty — plus the default password **`clusev`**), -and the **`clusev` host user** + its random password (shown **only once** — note it down). +(your e-mail — `admin@clusev.local` if you left it empty — plus a **random one-time password**), and +the **`clusev` host user** + its own random password. Both passwords are shown **only once** — note +them down. ### First login -Log in with your admin e-mail and the password **`clusev`** — the panel then **forces you to set a new -password immediately**. Do this right away: `clusev` is a known default, so the account is only safe -once changed. You can change the login e-mail later under **Settings → Profile**. 2FA is **optional but -recommended** — enable TOTP and/or a security key from **Settings → Security** whenever you like. +Log in with your admin e-mail and the **one-time password from the installer's summary**. Setting your +own password is **recommended** — a banner keeps reminding you until you do — but no longer forced, so a +missed reminder can never lock you out of your own panel. You can change the login e-mail later under +**Settings → Profile**. 2FA is **optional but recommended** — enable TOTP and/or a security key from +**Settings → Security** whenever you like. A short **guided tour** highlights the key areas on first +login (replay it any time from Settings). --- @@ -163,7 +166,8 @@ rather than failing silently. - **Bare IP (no domain):** served over plain HTTP at `http://`. This address always stays reachable as a recovery path, even after a domain is configured. -- **With a domain:** set it during install or later under **System → Domain & TLS**. The panel +- **With a domain:** set it in the dashboard under **System → Domain & TLS** at any time (or preset + `CLUSEV_DOMAIN` at install for an unattended setup). The panel obtains and renews a Let's Encrypt certificate automatically and serves HTTPS — just point DNS at the server. (Let's Encrypt needs publicly reachable ports 80/443.) - **Behind your own reverse proxy** (one that already terminates TLS): switch _TLS-Terminierung_ to