Skip to main content

Changing the Initial Password (Commissioning Required)

This is the procedure for cleaning up accounts on screens that humans log into, after installing the AI stack. Rotation of keys used between services is covered in Changing Passwords · API Keys.

Admin Console Account​

The AI Admin Console sets its account via environment variables. Since no user is stored in the database, there is no on-screen password change function.

Environment VariableMeaningDefault
PI_ADMIN_USERLogin IDadmin
PI_ADMIN_PASSWORDLogin passwordNone — must be specified at install time
PI_ADMIN_SESSION_SECRETSession signing keyGenerated by the installer (a random value starting with ppss_)
The names differ inside the container

The console container (plantpulse-admin-api) receives these values under the names ADMIN_AUTH_USERNAME · ADMIN_AUTH_PASSWORD · ADMIN_SESSION_SECRET. Compose carries them across, so what the operator edits is the PI_* name in the table above.

There is no default password here

PI_ADMIN_PASSWORD in the template is a placeholder (CHANGE_ME_…), and the installer does not generate this value — because a human logs in with it. If it stays a placeholder, START=1 startup is refused, and if left blank the console refuses to start. In other words, the "we were still using the default" scenario cannot happen here. Since the value set at install time becomes the operating value, check once at commissioning time that it isn't a weak value chosen temporarily.

How to Change It​

The console account is not included in the list of keys managed by bin/passwd.sh. Edit the environment file directly and recreate the container.

sudo vi /etc/kopens/plantpulse-ai.env      # PI_ADMIN_PASSWORD 수정
cd /opt/kopens/plantpulse-ai-docker/bin
./up.sh                                    # 컨테이너 재생성
Changing the session signing key logs everyone out

PI_ADMIN_SESSION_SECRET is generated once at install time. Changing its value invalidates all logins up to that point. If left blank, compose refuses to start.

LiteLLM Admin Screen Account​

This is the account humans use to access the model gateway (LiteLLM)'s admin screen http://<AI 서버>:4000/ui (or whatever port, if you changed it to PI_LITELLM_PORT). It is not used for API calls (those use the master key or virtual keys).

Environment VariableMeaningDefault
PI_LITELLM_UI_USERNAMELogin IDadmin (commented out in the template)
PI_LITELLM_UI_PASSWORDLogin passwordadmin123!
This password is the same across all installations — change it at commissioning time

admin123! is the value written in the template, and the installer does not regenerate it. Since port 4000 is open on the LAN, leaving it as-is allows anyone on the same network to access the gateway admin screen.

Do not delete this line

PI_LITELLM_UI_PASSWORD is required — if it is empty or missing, compose refuses to start. Without this value, LiteLLM uses the master key (PI_LLM_API_KEY) as the UI password, so this exists separately to prevent a human from having to type in a key that opens the entire API.

The way to change it is the same as for the console account — since it's not in the passwd.sh list, edit the environment file and recreate with ./up.sh.

If you upgraded a host installed at 2026.08 or earlier to 2026.09

This account was introduced in 2026.09. Since the installer does not recreate an existing environment file, older files will not have this line. Upgrading as-is will halt startup with an error saying PI_LITELLM_UI_PASSWORD is missing. Add it directly to /etc/kopens/plantpulse-ai.env (using your newly chosen password as the value).

PI_LITELLM_UI_PASSWORD=<password>

Infrastructure Accounts and API Keys​

These are credentials used between services. bin/passwd.sh holds the target list.

cd /opt/kopens/plantpulse-ai-docker/bin

./passwd.sh --list          # 무엇을 바꿀 수 있는지 (현재값은 마스킹)
./passwd.sh --list --show   # 현재값 전체
./passwd.sh PI_INBOUND_API_KEY
./passwd.sh --generate PI_INBOUND_API_KEY   # 값을 직접 만들지 않고 도구가 만들게
KeyWhat
PI_NEO4J_PASSWORDNeo4j — change both instances together: the LightRAG knowledge graph and the factory graph mirror
PI_RAG_API_KEYRAG API key — shared by copliot-web · lightrag · rag-api
PI_VLLM_API_KEYvLLM API key — shared by lightrag · insight-api
PI_LLM_API_KEYLiteLLM master key
PI_LITELLM_SALT_KEYLiteLLM salt key — 🔴 Changing this breaks decryption of already-registered external model keys. Do not rotate it
PI_INBOUND_API_KEYBackend inbound key — received by rag · insight · parser · vision · digital thread (if empty, those five refuse to start), and called with the same value by copilot · admin console
The two stored-credential encryption keys are not on this list

PI_COPILOT_SECRET_KEY · PI_DT_SECRET_KEY are generated by the installer at first install, and are not values to change at commissioning time — changing them makes credentials sealed with those keys undecryptable. There are two things to do.

  1. Check that the values exist. If PI_COPILOT_SECRET_KEY is empty, Copilot refuses to start. Hosts upgraded from 2026.09 or earlier may not have the line at all → Environment Variable Settings
  2. Make sure both values are included in env file backups.

If replacement is truly necessary, follow the _PREVIOUS procedure → Changing Passwords · API Keys

A «placeholder» inbound key is dangerous

If empty, the pre-start check will not bring the stack up at all, and backend services each refuse to start individually (from the 2026.10 re-release onward — before that, services treated "no key" as a pass). However, the CHANGE_ME_… placeholder is not an empty value, so it passes that check, and its value is the same string across all installations. Since the installer replaces the placeholder with a new value, check right after installation with bin/doctor.sh that no placeholder remains. Rotation follows the order of passwd.sh: edit the file first, then restart. Follow the same order when editing manually.

Many services share the same keys

PI_RAG_API_KEY · PI_VLLM_API_KEY · PI_INBOUND_API_KEY have multiple consumers. If you change only one place, the rest will fail authentication, so change via passwd.sh and restart the entire stack.

Verification​

# 콘솔이 떴는가 — HTTP 5959 · HTTPS 5960 (2026.09 까지는 9080)
curl -sf http://127.0.0.1:5959/health && echo OK
curl -sfk https://127.0.0.1:5960/health && echo OK

Confirm directly in a browser that login with the old password is blocked.

What This Page Does Not Cover​

TargetWhere
Backend inbound key · LLM key · Neo4j, etc.Changing Passwords · API Keys
Public API (/api/v1) machine authentication key CO_API_V1_KEY (CH_API_V1_KEY until 2026.09)Environment Variable Settings
AI Chat Web user accountsFollows the platform user system → Platform User Management
Initial accounts for Platform·Edge·StudioSee the same-named page in each product's documentation