> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spitzli.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Initial operator setup

> Create the first native operator and registered Console client through the offline Rust CLI.

For a new empty operator-owned installation, after native migrations complete, create the first operator with `webdock-bootstrap-operator`. This explicit offline operation uses a dedicated non-superuser migration login and refuses existing identity, client, signing-key or audit state. It never changes an existing operator password.

## Prepare private input

Supply `DATABASE_URL_UNPOOLED`, the retained identity/RLS secrets and exact canonical origins in the private command environment. Prepare an owner-only JSON file with `email`, `name`, `password`, `authOrigin`, `studioOrigin` and `consoleOrigin`. The origins must exactly match the environment and be distinct. HTTPS is required outside explicitly allowed loopback development. The password may instead come from `WEBDOCK_INITIAL_OPERATOR_PASSWORD`; provide it in only one place.

The input and output contain credentials. Keep them out of source control, logs and browser storage. Do not use production identities in acceptance tests.

## Run once

```sh theme={null}
bun run setup:admin --target db.example.invalid:5432/webdock --config /private/operator-input.json --output /private/operator-output.json
```

The target must exactly match the connected database. The CLI creates the operator, local registry mapping, confidential Portal client and private output atomically. It creates the output without overwriting an existing file. If the commit is uncertain, preserve the output and inspect its recorded identifiers before retrying.

The private output supplies the registered Console client and cookie configuration for Core. Complete password replacement and real MFA on the canonical account surface before operator work. Existing installations use reviewed account/client adoption instead of first-install bootstrap.

See `crates/control-plane/README.md` for the complete native environment and bootstrap contract. The old temporary TypeScript setup server is archived with the retired platform and is not part of the native startup path.

Hosted Spitzli Cloud already uses Neon Managed Auth for all users with Core MFA. Do not run empty-install bootstrap against an existing installation or treat a locally created account as a managed-auth bypass. Existing identity adoption and provider binding require their reviewed workflow.

Source: offline bootstrap (`crates/control-plane/src/bin`) and [browser identity boundary](https://docs.spitzli.cloud/developers/auth-adapters.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.