Change Initial Password (Commissioning Required)

This procedure governs account setup on the human login screen after you install the AI stack. Service-to-service key rotation is covered under Password · API Key Management.

---

Admin Console Account

The AI Admin Console manages accounts by environment variable. There is no user database, so the console has no password-change feature in the UI.

Environment Variable	Purpose	Default
ADMIN_AUTH_USERNAME	Login ID	admin
ADMIN_AUTH_PASSWORD	Login password	None — you must set this during installation
ADMIN_SESSION_SECRET	Session signing key	Regenerated on each startup if empty

No default password here

If you leave ADMIN_AUTH_PASSWORD empty, the console will refuse to start. This means "accidentally running with the default" cannot happen. The value you set at installation becomes your operational password, so verify during commissioning that it is not a weak temporary value.

How to Change It

The bin/passwd.sh key store does not list the console account. Edit the environment file directly and restart.

sudo vi /etc/kopens/plantpulse-ai.env      # ADMIN_AUTH_PASSWORD 수정
cd /home/kopens/plantpulse-ai/bin
./up.sh                                    # 컨테이너 재생성

Leaving the session signing key empty logs you out on every restart

Without ADMIN_SESSION_SECRET, a new key is generated each time the service starts. If you set a value, login persists across restarts.

---

Infrastructure Accounts and API Keys

These are service-to-service credentials. bin/passwd.sh maintains the target list.

cd /home/kopens/plantpulse-ai/bin

./passwd.sh --list          # 무엇을 바꿀 수 있는지 (현재값은 마스킹)
./passwd.sh --list --show   # 현재값 전체
./passwd.sh PP_INBOUND_API_KEY

Key	Purpose
DOCKER_NEO4J_PASSWORD	Neo4j (graph storage)
RAG_API_KEY	RAG API key — shared by copliot-web, lightrag, and rag-api
VLLM_API_KEY	vLLM API key — shared by lightrag and insight-api
LITELLM_MASTER_KEY	LiteLLM master key
LITELLM_SALT_KEY	LiteLLM salt key
PP_INBOUND_API_KEY	Backend inbound key — shared by rag, insight, parser, and vision

Do not leave PP_INBOUND_API_KEY empty

An empty key causes all four backend services to become unauthenticated (each service treats "no key" as a pass-through). During rotation, prevent the empty value from leaking by having passwd.sh update the file first, then restart. Follow the same order when editing manually.

Many keys are shared across services

RAG_API_KEY · VLLM_API_KEY · PP_INBOUND_API_KEY have multiple consumers. Changing only one breaks authentication for the rest, so update via passwd.sh and restart the entire stack.

---

Verification

# 콘솔이 떴는가
curl -sf http://127.0.0.1:9080/ping && echo OK

Verify in your browser that login with the old password is blocked.

---

Topics Not Covered Here

Subject	Location
Backend inbound key, LLM key, Neo4j, and others	Password · API Key Management
AI Chat Web user accounts	Follow the platform user system → Platform User Management
Initial accounts for Platform, Edge, and Studio	See the same-named page in each product's documentation

---

Related Documentation

• AI Admin Console — console usage and session policy
• Password · API Key Management — key rotation overview
• Installation and Configuration