Password starting with "!" results in a crash when starting pangolin container. #32

New Issue

2025-11-13T11:48:05-06:00

GiteaMirror commented

2025-11-13 11:48:05 -06:00

Originally created by @Sinofage on GitHub (Jan 22, 2025).

Error: Error loading configuration file: unknown tag !<!password> (46:1)

43 | email: sinofage@gmail.com
44 | password: !password
45 |
46 | flags:
------^
47 | require_email_verification: ...
48 | disable_signup_without_invi ...
at loadConfig (/app/server/lib/config.ts:163:27)
at Config.loadConfig (/app/server/lib/config.ts:173:27)
at new Config (/app/server/lib/config.ts:146:14)
at (/app/server/lib/config.ts:334:23)

Node.js v20.18.1

Originally created by @Sinofage on GitHub (Jan 22, 2025). Error: Error loading configuration file: unknown tag !<!password> (46:1) 43 | email: sinofage@gmail.com 44 | password: !password 45 | 46 | flags: ------^ 47 | require_email_verification: ... 48 | disable_signup_without_invi ... at loadConfig (/app/server/lib/config.ts:163:27) at Config.loadConfig (/app/server/lib/config.ts:173:27) at new Config (/app/server/lib/config.ts:146:14) at <anonymous> (/app/server/lib/config.ts:334:23) Node.js v20.18.1

GiteaMirror closed this issue

2025-11-13 11:48:05 -06:00

GiteaMirror commented

2025-11-13 11:48:06 -06:00

@miloschwartz commented on GitHub (Jan 22, 2025):

In YAML adding ! before a string indicates a tag or type. If you want to put ! in the beginning, you should surround the string with double quotes, like: password: "!password".

Also, this password will be rejected because it's not strong enough.

Admin Password: Must meet these requirements:

At least 8 characters
At least one uppercase letter
At least one lowercase letter
At least one digit
At least one special character

@miloschwartz commented on GitHub (Jan 22, 2025): In YAML adding `!` before a string indicates a tag or type. If you want to put `!` in the beginning, you should surround the string with double quotes, like: `password: "!password"`. Also, this password will be rejected because it's not strong enough. Admin Password: Must meet these requirements: - At least 8 characters - At least one uppercase letter - At least one lowercase letter - At least one digit - At least one special character

GiteaMirror commented

2025-11-13 11:48:06 -06:00

@Sinofage commented on GitHub (Jan 22, 2025):

"!password" isn't the real password, I have changed it from my original password that was inside the log.
But regardless of how strong or weak my password, there underling issue regarding there's no heads up on needing to add "" to the password, if you have ! as first latter in the password.
Don't think it's major issue but something should notify the end user he can't use ! as the first latter in password.

@Sinofage commented on GitHub (Jan 22, 2025): "!password" isn't the real password, I have changed it from my original password that was inside the log. But regardless of how strong or weak my password, there underling issue regarding there's no heads up on needing to add "" to the password, if you have ! as first latter in the password. Don't think it's major issue but something should notify the end user he can't use ! as the first latter in password.

GiteaMirror commented

2025-11-13 11:48:06 -06:00

@miloschwartz commented on GitHub (Jan 22, 2025):

That's fair, and I agree we should make this more clear. Did you use the installer script? I can update that script to use the quotes when creating the config files. I can also update the docs to use quotes in case someone copies.

@miloschwartz commented on GitHub (Jan 22, 2025): That's fair, and I agree we should make this more clear. Did you use the installer script? I can update that script to use the quotes when creating the config files. I can also update the docs to use quotes in case someone copies.

GiteaMirror commented

2025-11-13 11:48:07 -06:00

@Sinofage commented on GitHub (Jan 22, 2025):

Yea I used the automated installer.

@Sinofage commented on GitHub (Jan 22, 2025): Yea I used the automated installer.

GiteaMirror commented

2025-11-13 11:48:07 -06:00

@miloschwartz commented on GitHub (Jan 22, 2025):

I will update the docs, and update the installer to use quotes for the next release. Thanks for pointing this out

@miloschwartz commented on GitHub (Jan 22, 2025): I will update the docs, and update the installer to use quotes for the next release. Thanks for pointing this out

GiteaMirror commented

2025-11-13 11:48:07 -06:00

@ItsSK commented on GitHub (Jan 23, 2025):

I have also confirmed that any special character as the first letter in the password triggers a failed to-start pangolin, simply adding quotes around the password in the config/config.yml fixes the issue, it also would be ideal to not hardcode the password but pass it during runtime.

@ItsSK commented on GitHub (Jan 23, 2025): I have also confirmed that any special character as the first letter in the password triggers a failed to-start pangolin, simply adding quotes around the password in the config/config.yml fixes the issue, it also would be ideal to not hardcode the password but pass it during runtime.

GiteaMirror commented

2025-11-13 11:48:07 -06:00

@miloschwartz commented on GitHub (Jan 23, 2025):

it also would be ideal to not hardcode the password but pass it during runtime.

It's not well documented right now, but you can pass the password at runtime by setting the USERS_SERVERADMIN_PASSWORD environment variable. This will override anything in the config file.

@miloschwartz commented on GitHub (Jan 23, 2025): > it also would be ideal to not hardcode the password but pass it during runtime. It's not well documented right now, but you can pass the password at runtime by setting the `USERS_SERVERADMIN_PASSWORD` environment variable. This will override anything in the config file.