goats

Overview ¶

Package main — first-boot admin bootstrap.

This file implements the one-shot admin bootstrap that consumes the GOATFLOW_ADMIN_PASSWORD environment variable.

Background: migration 000002 seeds the system admin (root@localhost) with a random OTRS-compatible password and valid_id = 2 (disabled), so no credential exists that a new install can log in with. Deployments that set GOATFLOW_ADMIN_PASSWORD (e.g. the TrueNAS community app, where it comes from the "Admin Password" field in the install wizard) expect that value to become the initial admin password automatically.

Safety model — the bootstrap is strictly first-boot-only:

• It only runs when the seeded admin row still exists AND is in its factory-disabled state (valid_id <> 1). The UPDATE itself carries the same condition, so even a race between the check and the write cannot clobber a live account.
• After a successful application it records a marker (sysconfig_modified: admin.bootstrap.applied = "true"). If the environment variable is still set afterwards (or a stale wizard value lingers after the user changed the password via the UI), every future startup is a no-op.
• The marker is written only AFTER the user update succeeded, so a failed or interrupted run retries on the next boot.

Failure semantics: any error here is logged and ignored — the server still starts, exactly like a migration warning. A failed bootstrap must never take the app down.