First-run setup

A fresh Flagpost install ships with no administrator account and no default password. Until the setup wizard runs, the instance is deliberately unconfigured: the app redirects to /setup, and public registration is blocked.

The wizard

Opening the app on a fresh install lands on the setup wizard, which:

1. Creates the owner account — the first Administrator, with credentials you choose on the spot (nothing is seeded or hard-coded).
2. Sets initial branding — the platform name your users will see.

The wizard is only available until the install is first provisioned: completing it (or seeding an owner any other way) stamps a one-way setup completed flag, and nothing clears it — even losing every active Administrator later does not reopen the wizard, which would turn an operator lockout into an anonymous takeover (GHSA-ccm4-9573-9965). Recovery from admin lockout is operational, never via the public wizard. Public registration then opens (if enabled) and never grants more than the Participant role — additional staff are promoted explicitly via role assignment.

The reasoning is recorded in ADR-0017: an install left on shipped default credentials is trivially compromised, so Flagpost refuses to have any.

After setup — a checklist

1. Appearance — palette, accent, and (optionally) your organisation’s logo: Site settings & branding.
2. Registration policy — leave self-registration open, or close it and mint accounts from Admin → Users.
3. SMTP — needed for the send_email automation action and self-service password resets; both quietly no-op without it.
4. Create your first competition — Competitions.
5. Going public? Work through Production deployment and Security notes.