Change Initial Password (Commissioning Required)
Immediately after installation, PlantPulse comes with the same default account across all installations. These values are documented in the source and known to everyone. You must change all of them before handing over to the customer.
This page is a single checklist of all accounts that must be changed and the path to change each one. For regular rotation during operation, see Change Password (Credential Rotation).
These accounts use different screens and different storage. If you change only the web console password and leave the Control Center as-is, a screen that can start, stop, and control the entire platform will be open with the default password.
What to change — complete list
| # | Account | Default | Where to change |
|---|---|---|---|
| 1 | Web Console admin | admin / admin123! | Console screen → below |
| 2 | Control Center (:9700) | admin / admin123! | Environment variable → below |
| 3 | Grafana (:3000) | admin / kopens123! | Environment variable → below |
| 4 | Kestra (:8380) | admin@plantpulse.io / Kopens123! | Environment variable → below |
| 5 | Infrastructure services (DB, MQ, storage, etc.) | Varies by installation | passwd.sh → below |
Items 1–4 are user-facing login screens and are covered here. Item 5 contains credentials used between services and has a separate rotation procedure.
1. Web Console admin
Change this first. The procedure completes within the screen.
- Log in with
admin/admin123!. - Open System > Users in the left menu.
- Click the 🔑 key icon (tooltip "Change password") in the
adminrow. - Enter the current password (
admin123!) and the new password, then save.
When changing another user's password, the ADMIN permission is enough. For your own account, you must also provide the current password. Full rules and REST API usage are in User Management — Change Password.
2. Control Center (:9700)
A separate web screen that starts, stops, and controls the entire platform with root privilege. It has completely different accounts from the web console, and changing the console password does not affect it.
Set it with two environment variables. If you provide values, they are used instead of defaults.
| Environment variable | Purpose |
|---|---|
PP_CONTROL_USER | Login username |
PP_CONTROL_PASSWORD | Login password |
If not set, all installations use the same development default account. For detailed application procedures, see Credential Rotation — Control Center.
Even after changing the password, it is essential to restrict this port to the operations network with a firewall → Port Configuration.
3. Grafana (:3000)
A time series visualization dashboard. The default account is admin / kopens123!.
| Environment variable | Default value |
|---|---|
PP_GRAFANA_ADMIN_USER | admin |
PP_GRAFANA_ADMIN_PASSWORD | kopens123! |
Set the values in the host's secret sidecar (/etc/kopens/plantpulse-platform.env) and restart with bin/restart.sh.
4. Kestra (:8380)
A workflow engine. The default account is admin@plantpulse.io / Kopens123!.
| Environment variable | Default value |
|---|---|
PP_KESTRA_ADMIN_EMAIL | admin@plantpulse.io |
PP_KESTRA_ADMIN_PASSWORD | Kopens123! |
In the current release, the warehouse service startup script hardcodes the Kestra account (the warehouse service startup script's KESTRA_USER · KESTRA_PASS). It does not read the above environment variables.
⇒ If you change the Kestra password, you must also update the values in that file. If you do not, S3 archive and optimization workflows will fail authentication, but no error appears on screen, so you discover it days later as "archives are not running."
This is reported as a product defect. When a fix is released, this guidance will be removed.
5. Infrastructure accounts and API keys
Credentials used between services, such as database, messaging, and storage. People do not log in, but with defaults in place, anyone on the internal network can reach the data.
bin/passwd.sh is the entry point. Only registered variables can be rotated; if you provide an unregistered value, it will not silently skip it but will reject it.
To rotate all registered values randomly at commissioning time, call the rotation engine directly. --all is an option for passwd.sh, not rotate-secret.sh.
cd /opt/kopens/plantpulse-platform-docker
bin/passwd.sh --list # 무엇을 바꿀 수 있는지 (현재값은 마스킹)
bin/passwd.sh --list --show # 현재값을 그대로 보기
bin/passwd.sh PP_PG_PASSWORD # 값은 프롬프트로 입력 (argv·셸 히스토리에 남지 않습니다)
bin/passwd.sh PP_PG_PASSWORD=... PP_MINIO_PASSWORD=... # 여러 개를 한 번에 → 재시작 1회
bin/passwd.sh --dry-run PP_MQ_PASSWORD # 계획만 출력
bin/rotate-secret.sh --dry-run --all --generate # 계획 확인
bin/rotate-secret.sh --all --generate # 실행
| Environment variable | Target |
|---|---|
PP_PG_PASSWORD | PostgreSQL plantpulse |
PP_TEMPORAL_PASSWORD | PostgreSQL temporal |
PP_HIVE_PASSWORD | PostgreSQL hive |
PP_CASSANDRA_PASSWORD | Cassandra |
PP_REDIS_PASSWORD | Valkey (Redis) |
PP_MINIO_PASSWORD | MinIO |
PP_MQ_PASSWORD | Kafka · HiveMQ (both services share one value) |
PP_CEP_API_KEY | CEP API |
PP_DATA_GATEWAY_API_KEY | Data gateway API |
PP_API_KEY · PP_FLOW_WEBHOOK_API_KEY · PP_SPARK_PASSWORD · PP_OPCUA_PASSWORD · TLS keystore/truststore passwords are not yet in the registry so the script will reject them. If you provide unregistered keys, it will not silently skip but will reject as «variable not in registry». Follow Credential Rotation — Manual Procedure for all of them.
If you change the server-side account and do not update the vault, the platform will not start on the next reboot. passwd.sh automates this order, but if you do it manually, read Why order matters first.
Verify after changes
Directly verify that login with the default password fails on each screen. "I thought I changed it but the config file was not read" is the most common failure.
| What to verify | Method |
|---|---|
| Web console | Log out and attempt login with admin123! → should fail |
| Grafana | Attempt login with kopens123! at :3000 → should fail |
| Kestra | Attempt login with Kopens123! at :8380 → should fail |
| S3 archive | If you changed Kestra, verify the next scheduled run succeeds |
Document the list of changed accounts and who holds the new passwords. Do not write the values themselves.
Related documents
- Change Password (Credential Rotation) — regular rotation during operation
- User Management — account creation, permissions, password rules
- Security Configuration — API authentication, TLS, security headers
- Port Configuration — which ports must not be exposed externally