Initial Password Change (Required at Commissioning)

Immediately after installation, PlantPulse has the same default accounts across all installations. These values are written in the source code and are known to anyone. Change all of them before handing over to the customer.

This page is a single checklist of all accounts that must be changed and the path to change each one. For regular rotation during operation, see Password Change (Credential Rotation).

If even one is left as-is, that one is the door

The accounts below use separate screens and separate storage. If you only change the web console password and leave the Control Center as-is, the screen that can start and stop the entire platform will be open with the default password.

---

What must be changed — Full list

#	Account	Default	Where to change
1	Web Console admin	admin / admin123!	Console screen → below
2	Control Center(:9700)	admin / admin123!	Environment variables → below
3	PlantPulse Dashboard(:3000)	admin / admin	Within the PlantPulse Dashboard screen → below
4	Kestra(:8380)	admin@plantpulse.io / Kopens123!	Environment variables → below
5	Infrastructure services (DB, MQ, storage, etc.)	Varies by installation	passwd.sh → below

Items 1–4 are screens that people log in to, so they are covered here. Item 5 contains credentials used between services, and has a separate rotation procedure.

---

1. Web Console admin

Change this first. It can be done entirely within the screen.

1. Log in with admin / admin123!.
2. Open the left menu System > Users.
3. Click the 🔑 key icon on the admin row (tooltip "Change password").
4. Enter the current password(admin123!) and the new password, then save.

Your own account requires the current password

Changing someone else's password only requires the ADMIN permission, but for your own account, you must enter the current password as well. For detailed rules and REST API usage, see User Management — Password Change.

---

2. Control Center (:9700)

A separate web screen that can start, stop, and control the entire platform with root privileges. Its account is completely separate from the web console, and changing the password in the console does not affect it.

It is set with two environment variables. If a value is provided, it is used instead of the default.

Environment variable	Purpose
PP_CONTROL_USER	Login username
PP_CONTROL_PASSWORD	Login password

If not set, the same development default account for all installations is used for login. For detailed application steps, see Credential Rotation — Control Center.

Do not expose port 9700 to the outside

Even if you change the password, the principle is to block this port with a firewall so that it is only reachable from the operator network → Port Configuration.

---

3. PlantPulse Dashboard (:3000)

A time series visualization dashboard. The default account is PlantPulse Dashboard's built-in default admin / admin.

Cannot be changed via environment variables

🔴 There are no variables called PP_GRAFANA_ADMIN_USER · PP_GRAFANA_ADMIN_PASSWORD. PlantPulse Dashboard's admin account lives in PlantPulse Dashboard's own storage, and the values in the configuration file are only consulted when there are no users in the storage — once created, the storage takes precedence, and there is no error to inform you of this. Therefore, we do not write them at all (decision on 2026-09-08).

There are two places to change it.

Method	When
PlantPulse Dashboard screen → Profile → Change password	Normally
dashboard-cli --homepath <dashboard> admin reset-admin-password --password-from-stdin	When login is not possible

Values that must be set together — PP_GRAFANA_DB_PASSWORD

As of 2026-09-08, PlantPulse Dashboard's storage is PostgreSQL(dashboards, datasources, users, alert rules). Its connection information is required.

Environment variable	Default
PP_GRAFANA_DB_USER	grafana (fixed — the schema creates roles with this name)
🔑 PP_GRAFANA_DB_PASSWORD	None — required at startup

🔴 If empty, pd start stops with exit code 3. Write it in the host's secret sidecar (/etc/kopens/plantpulse-platform.env) and restart via bin/restart.sh.

---

4. Kestra (:8380)

A workflow engine. The default account is admin@plantpulse.io / Kopens123!.

Environment variable	Default
PP_KESTRA_ADMIN_EMAIL	admin@plantpulse.io
PP_KESTRA_ADMIN_PASSWORD	Kopens123!

The warning that used to be here about "archives stopping if changed" has been removed

Before 2026-09-04, the warehouse connected to Kestra via HTTP, and the startup script hardcoded that account, so changing the Kestra password silently stopped the S3 archive.

That path no longer exists. Archive and optimization are run by Temporal workers (PP-S3-ARCHIVER-DAILY daily at 01:30 · PP-S3-OPTIMIZER-WEEKLY Sunday at 04:00). The warehouse does not read or hold Kestra credentials.

⇒ Change the Kestra password with confidence. It has no effect on the archive.

---

5. Infrastructure accounts and API keys

These are credentials used between services, such as databases, messaging, and storage. People don't log in with them, but if left at default values, anyone on the internal network can access the data.

bin/passwd.sh is the front door. Only variables registered in the registry can be rotated; if you provide an unregistered value, it will be rejected, not silently skipped.

cd /opt/kopens/plantpulse-platform-docker

bin/passwd.sh --list                 # 무엇을 바꿀 수 있는지 (현재값은 마스킹)
bin/passwd.sh --list --show          # 현재값을 그대로 보기
bin/passwd.sh PP_PG_PASSWORD         # 값은 프롬프트로 입력 (argv·셸 히스토리에 남지 않습니다)
bin/passwd.sh PP_PG_PASSWORD=... PP_S3_PASSWORD=...   # 여러 개를 한 번에 → 재시작 1회
bin/passwd.sh --dry-run PP_MQ_PASSWORD                   # 계획만 출력

To rotate all registered values to random values at commissioning time, call the rotation engine directly. --all is not passwd.sh but an option of rotate-secret.sh.

bin/rotate-secret.sh --dry-run --all --generate   # 계획 확인
bin/rotate-secret.sh --all --generate             # 실행

Environment variable	Target
PP_PG_PASSWORD	PostgreSQL plantpulse
PP_TEMPORAL_PASSWORD	PostgreSQL temporal
PP_HIVE_PASSWORD	PostgreSQL hive
PP_CASSANDRA_PASSWORD	Aster TSDB
PP_REDIS_PASSWORD	Valkey (Redis)
PP_S3_PASSWORD	RustFS
PP_MQ_PASSWORD	Kafka · HiveMQ (Both services share a single value)
PP_CEP_API_KEY	CEP API
PP_DATA_GATEWAY_API_KEY	Data Gateway API

These 9 are not all

PP_API_KEY · PP_FLOW_WEBHOOK_API_KEY · PP_SPARK_PASSWORD · PP_OPCUA_PASSWORD TLS keystore/truststore passwords are not yet in the registry, so the script rejects them. If you provide an unregistered key, it will be rejected as an "unregistered variable," not silently skipped. Follow all of Credential Rotation — Manual Procedure.

Follow the order

If you change the server-side account without updating the stored value, the platform will not start on the next restart. passwd.sh handles this order for you, but when doing it manually, first read Why the Order Matters.

---

Verification after the change

Directly verify that login with the default password no longer works on each screen. "I thought I changed it, but the config file wasn't read" is the most common failure.

What to check	Method
Web console	After logging out, try logging in with admin123! → should fail
PlantPulse Dashboard	Try logging in with :3000 using admin / admin → should fail
Kestra	Try logging in with :8380 using Kopens123! → should fail
S3 archive	If Kestra was changed, check that the next scheduled run succeeded

Record it in the handover document

Write the list of changed accounts and who holds the new passwords in the handover document. Do not write the values themselves.

---

Related documents

• Password Change (Credential Rotation) — regular rotation during operation
• User Management — account creation, permissions, password rules
• Security Settings — API authentication, TLS, security headers
• Port Configuration — which ports should not be exposed externally