Skip to main content
For a new empty operator-owned installation, after native migrations complete, create the first operator with webdock-bootstrap-operator. This explicit offline operation uses a dedicated non-superuser migration login and refuses existing identity, client, signing-key or audit state. It never changes an existing operator password.

​
Prepare private input

Supply DATABASE_URL_UNPOOLED, the retained identity/RLS secrets and exact canonical origins in the private command environment. Prepare an owner-only JSON file with email, name, password, authOrigin, studioOrigin and consoleOrigin. The origins must exactly match the environment and be distinct. HTTPS is required outside explicitly allowed loopback development. The password may instead come from WEBDOCK_INITIAL_OPERATOR_PASSWORD; provide it in only one place. The input and output contain credentials. Keep them out of source control, logs and browser storage. Do not use production identities in acceptance tests.

​
Run once

The target must exactly match the connected database. The CLI creates the operator, local registry mapping, confidential Portal client and private output atomically. It creates the output without overwriting an existing file. If the commit is uncertain, preserve the output and inspect its recorded identifiers before retrying. The private output supplies the registered Console client and cookie configuration for Core. Complete password replacement and real MFA on the canonical account surface before operator work. Existing installations use reviewed account/client adoption instead of first-install bootstrap. See crates/control-plane/README.md for the complete native environment and bootstrap contract. The old temporary TypeScript setup server is archived with the retired platform and is not part of the native startup path. Hosted Spitzli Cloud already uses Neon Managed Auth for all users with Core MFA. Do not run empty-install bootstrap against an existing installation or treat a locally created account as a managed-auth bypass. Existing identity adoption and provider binding require their reviewed workflow. Source: offline bootstrap (crates/control-plane/src/bin) and browser identity boundary.