🛡️ Security Enhancement: Setup Token for Initial Server Setup
Problem
When spinning up a new Pangolin server, anyone in the world could potentially access the initial setup page and create the first admin account before the legitimate administrator, posing a security risk.
Solution
Implemented a setup token system that requires a secure token to be entered during the initial server setup process. The token is generated and displayed in the server console on startup until the token is used.
Initial Setup Page
Navigate to http://localhost:3002/auth/initial-setup.
You should see a new "Setup Token" field at the top.
Enter the token from the server console.
Fill in the email and password fields.
Submit the form.
Expected Behavior:
✅ The form accepts a valid token and creates the admin.
❌ The form rejects an invalid token with an error message.
Screenshots
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/1208
**Author:** [@adrianeastles](https://github.com/adrianeastles)
**Created:** 8/3/2025
**Status:** ✅ Merged
**Merged:** 8/13/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `dev` ← **Head:** `feature/setup-token-security`
---
### 📝 Commits (10+)
- [`b5afd73`](https://github.com/fosrl/pangolin/commit/b5afd7302475abc58cef5bf6ea9d6285992da382) Initial plan
- [`4f5091e`](https://github.com/fosrl/pangolin/commit/4f5091ed7f9342c9407411f19b39013750483a87) Initial commit: Document plan to fix ESLint issues
- [`2259879`](https://github.com/fosrl/pangolin/commit/2259879595da744ace17172e1815182b06313d8a) Fix ESLint issues: prefer-const warnings and missing semicolons
- [`39c43c0`](https://github.com/fosrl/pangolin/commit/39c43c0c0981bf08a7203a6f6b9fb992be82e022) modified: .github/workflows/cicd.yml
- [`a2526ea`](https://github.com/fosrl/pangolin/commit/a2526ea2441a47e666f21afed2990af13c615f98) Revert mappings variable from const to let in getAllRelays.ts
- [`27ac204`](https://github.com/fosrl/pangolin/commit/27ac204bb6adc8adf748077f86a47633671aee27) Fix variables incorrectly changed from let to const - revert to let where variables are reassigned
- [`481714f`](https://github.com/fosrl/pangolin/commit/481714f095d2e8a4a1e34207bb3569194bcc3538) Fix for issues with binding ports other than 80/443
- [`961008b`](https://github.com/fosrl/pangolin/commit/961008bbe16ccb6538bb2cda524ba0262ac49bdf) fix: adapt nix run command
- [`07b8652`](https://github.com/fosrl/pangolin/commit/07b86521a500f1a4c295f5ec37a41564beb72dac) Merge pull request #1196 from confusedalex/fix-nix
- [`f75169f`](https://github.com/fosrl/pangolin/commit/f75169fc26b5d577cf4a92259ff4f85d0bdc4247) Add missing langs
### 📊 Changes
**95 files changed** (+4323 additions, -3201 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/linting.yml` (+1 -1)
📝 `.github/workflows/test.yml` (+1 -1)
📝 `.nvmrc` (+1 -1)
📝 `Dockerfile.dev` (+1 -1)
📝 `Dockerfile.pg` (+2 -2)
📝 `Dockerfile.sqlite` (+2 -2)
📝 `README.md` (+1 -1)
➕ `cli/commands/resetUserSecurityKeys.ts` (+67 -0)
📝 `cli/index.ts` (+2 -0)
📝 `esbuild.mjs` (+1 -1)
📝 `install/config/docker-compose.yml` (+1 -1)
📝 `install/input.txt` (+1 -0)
📝 `install/main.go` (+165 -3)
➕ `messages/bg-BG.json` (+1327 -0)
📝 `messages/cs-CZ.json` (+6 -1)
📝 `messages/de-DE.json` (+67 -62)
📝 `messages/en-US.json` (+4 -1)
📝 `messages/es-ES.json` (+6 -1)
📝 `messages/fr-FR.json` (+6 -1)
📝 `messages/it-IT.json` (+6 -1)
_...and 75 more files_
</details>
### 📄 Description
### 🛡️ Security Enhancement: Setup Token for Initial Server Setup
### Problem
When spinning up a new Pangolin server, anyone in the world could potentially access the initial setup page and create the first admin account before the legitimate administrator, posing a security risk.
### Solution
Implemented a setup token system that requires a secure token to be entered during the initial server setup process. The token is generated and displayed in the server console on startup until the token is used.
### **Initial Setup Page**
1. Navigate to `http://localhost:3002/auth/initial-setup`.
2. You should see a new "Setup Token" field at the top.
3. Enter the token from the server console.
4. Fill in the email and password fields.
5. Submit the form.
6. **Expected Behavior:**
* ✅ The form accepts a valid token and creates the admin.
* ❌ The form rejects an invalid token with an error message.
### Screenshots
<img width="828" height="162" alt="Screenshot 2025-08-03 at 9 25 33 pm" src="https://github.com/user-attachments/assets/7b2b3835-cc79-445b-b061-a93ba92e4ea0" />
<img width="460" height="657" alt="Screenshot 2025-08-03 at 9 27 23 pm" src="https://github.com/user-attachments/assets/30254493-1ca2-4d67-95ee-3df931423417" />
<img width="469" height="736" alt="Screenshot 2025-08-03 at 9 27 46 pm" src="https://github.com/user-attachments/assets/193d6fae-0362-4296-9630-f1e428a710fe" />
<img width="818" height="123" alt="Screenshot 2025-08-03 at 9 28 15 pm" src="https://github.com/user-attachments/assets/414db17f-223b-463c-ae4d-535f61827218" />
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/1208
Author: @adrianeastles
Created: 8/3/2025
Status: ✅ Merged
Merged: 8/13/2025
Merged by: @oschwartz10612
Base:
dev← Head:feature/setup-token-security📝 Commits (10+)
b5afd73Initial plan4f5091eInitial commit: Document plan to fix ESLint issues2259879Fix ESLint issues: prefer-const warnings and missing semicolons39c43c0modified: .github/workflows/cicd.ymla2526eaRevert mappings variable from const to let in getAllRelays.ts27ac204Fix variables incorrectly changed from let to const - revert to let where variables are reassigned481714fFix for issues with binding ports other than 80/443961008bfix: adapt nix run command07b8652Merge pull request #1196 from confusedalex/fix-nixf75169fAdd missing langs📊 Changes
95 files changed (+4323 additions, -3201 deletions)
View changed files
📝
.github/workflows/linting.yml(+1 -1)📝
.github/workflows/test.yml(+1 -1)📝
.nvmrc(+1 -1)📝
Dockerfile.dev(+1 -1)📝
Dockerfile.pg(+2 -2)📝
Dockerfile.sqlite(+2 -2)📝
README.md(+1 -1)➕
cli/commands/resetUserSecurityKeys.ts(+67 -0)📝
cli/index.ts(+2 -0)📝
esbuild.mjs(+1 -1)📝
install/config/docker-compose.yml(+1 -1)📝
install/input.txt(+1 -0)📝
install/main.go(+165 -3)➕
messages/bg-BG.json(+1327 -0)📝
messages/cs-CZ.json(+6 -1)📝
messages/de-DE.json(+67 -62)📝
messages/en-US.json(+4 -1)📝
messages/es-ES.json(+6 -1)📝
messages/fr-FR.json(+6 -1)📝
messages/it-IT.json(+6 -1)...and 75 more files
📄 Description
🛡️ Security Enhancement: Setup Token for Initial Server Setup
Problem
When spinning up a new Pangolin server, anyone in the world could potentially access the initial setup page and create the first admin account before the legitimate administrator, posing a security risk.
Solution
Implemented a setup token system that requires a secure token to be entered during the initial server setup process. The token is generated and displayed in the server console on startup until the token is used.
Initial Setup Page
http://localhost:3002/auth/initial-setup.Screenshots
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.