Use DEFAULT_ADMIN_EMAIL everywhere to prevent legacy key usage warnings on fresh installs (#1509)

2026-01-27 10:18:54 +00:00 · 2023-03-13 15:33:53 -06:00
parent a472883b86
commit 6eba82499a
9 changed files with 50 additions and 33 deletions
--- a/apps/fz_http/lib/fz_http/release.ex
+++ b/apps/fz_http/lib/fz_http/release.ex
@@ -26,12 +26,14 @@ defmodule FzHttp.Release do
  def create_admin_user do
    boot_database_app()

-    if Repo.exists?(from u in User, where: u.email == ^email()) do
+    if Repo.exists?(from(u in User, where: u.email == ^email())) do
      change_password(email(), default_password())
      {:ok, user} = reset_role(email(), :admin)

      # Notify the user
-      Logger.info("Password for user specified by ADMIN_EMAIL reset to DEFAULT_ADMIN_PASSWORD!")
+      Logger.info(
+        "Password for user specified by DEFAULT_ADMIN_EMAIL reset to DEFAULT_ADMIN_PASSWORD!"
+      )

      {:ok, user}
    else
@@ -43,7 +45,7 @@ defmodule FzHttp.Release do
             }) do
        # Notify the user
        Logger.info(
-          "An admin user specified by ADMIN_EMAIL is created with a DEFAULT_ADMIN_PASSWORD!"
+          "An admin user specified by DEFAULT_ADMIN_EMAIL is created with a DEFAULT_ADMIN_PASSWORD!"
        )

        {:ok, user}
--- a/apps/fz_http/priv/repo/migrations/20211221183311_add_role_to_users.exs
+++ b/apps/fz_http/priv/repo/migrations/20211221183311_add_role_to_users.exs
@@ -14,7 +14,7 @@ defmodule FzHttp.Repo.Migrations.AddRoleToUsers do
    # Make existing admin the admin if exists. Admin is most likely the first created user.
    flush()

-    admin_email = System.get_env("ADMIN_EMAIL")
+    admin_email = System.get_env("ADMIN_EMAIL") || System.get_env("DEFAULT_ADMIN_EMAIL")

    if admin_email do
      execute("UPDATE users SET role = 'admin' WHERE email = '#{admin_email}'")
--- a/rel/overlays/bin/gen-env
+++ b/rel/overlays/bin/gen-env
@@ -3,7 +3,7 @@
 cat <<-EOF
 VERSION=latest
 EXTERNAL_URL=_CHANGE_ME_
-ADMIN_EMAIL=_CHANGE_ME_
+DEFAULT_ADMIN_EMAIL=_CHANGE_ME_
 DEFAULT_ADMIN_PASSWORD=$(openssl rand -base64 12)
 GUARDIAN_SECRET_KEY=$(openssl rand -base64 48)
 SECRET_KEY_BASE=$(openssl rand -base64 48)
--- a/scripts/docker_migrate.sh
+++ b/scripts/docker_migrate.sh
@@ -124,7 +124,7 @@ migrate () {

  # BEGIN env vars that matter
  condIns $env_files "EXTERNAL_URL"
-  condIns $env_files "ADMIN_EMAIL"
+  condIns $env_files "DEFAULT_ADMIN_EMAIL"
  condIns $env_files "GUARDIAN_SECRET_KEY"
  condIns $env_files "DATABASE_ENCRYPTION_KEY"
  condIns $env_files "SECRET_KEY_BASE"
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -142,7 +142,7 @@ firezoneSetup() {
  fi
  db_pass=$(od -vN "8" -An -tx1 /dev/urandom | tr -d " \n" ; echo)
  docker run --rm firezone/firezone bin/gen-env > "$installDir/.env"
-  sed -i.bak "s/ADMIN_EMAIL=.*/ADMIN_EMAIL=$1/" "$installDir/.env"
+  sed -i.bak "s/DEFAULT_ADMIN_EMAIL=.*/DEFAULT_ADMIN_EMAIL=$1/" "$installDir/.env"
  sed -i.bak "s~EXTERNAL_URL=.*~EXTERNAL_URL=$2~" "$installDir/.env"
  sed -i.bak "s/DATABASE_PASSWORD=.*/DATABASE_PASSWORD=$db_pass/" "$installDir/.env"
  echo "TLS_OPTS=\"$3\"" >> "$installDir/.env"
@@ -178,7 +178,7 @@ Installation complete!
 You should now be able to log into the Web UI at $externalUrl with the
 following credentials:

-`grep ADMIN_EMAIL $installDir/.env`
+`grep DEFAULT_ADMIN_EMAIL $installDir/.env`
 `grep DEFAULT_ADMIN_PASSWORD $installDir/.env`

 EOF
--- a/www/docs/administer/troubleshoot.mdx
+++ b/www/docs/administer/troubleshoot.mdx
@@ -151,7 +151,7 @@ To                         Action      From

 ## Admin login isn't working

-If the password for the account with email `ADMIN_EMAIL` isn't working, you can
+If the password for the account with email `DEFAULT_ADMIN_EMAIL` isn't working, you can
 reset it using the process below.

 <Tabs>
@@ -160,7 +160,7 @@ reset it using the process below.
 First change directory to your Firezone installation directory
 (`$HOME/.firezone` by default), then run the `bin/create-or-reset-admin` script
 to reset the admin user's password. The password for the user specified by
-`ADMIN_EMAIL`
+`DEFAULT_ADMIN_EMAIL`
 in `$HOME/.firezone/.env` will be reset to the `DEFAULT_ADMIN_PASSWORD` variable.

 ```shell
--- a/www/docs/deploy/docker/README.mdx
+++ b/www/docs/deploy/docker/README.mdx
@@ -1,8 +1,7 @@
 ---
 title: Docker
 sidebar_position: 2
-description:
-  Install Firezone via Docker to manage secure remote
+description: Install Firezone via Docker to manage secure remote
  access to private networks and resources.
 ---

@@ -26,14 +25,14 @@ deploying Firezone. Docker offers a number of benefits over the old

 ## Step 1: Prerequisites

-* Ensure you're on a [supported platform](supported-platforms) with [
+- Ensure you're on a [supported platform](supported-platforms) with [
  docker-compose](https://docs.docker.com/compose/install/) **version 2
  or higher** installed.
-* Ensure port forwarding is enabled on your firewall.
+- Ensure port forwarding is enabled on your firewall.
  The default Firezone configuration requires the following ports to be open:
-  * `80/tcp` (optional): For automatically issuing SSL certificates.
-  * `443/tcp`: To access the web UI.
-  * `51820/udp`: VPN traffic listen port.
+  - `80/tcp` (optional): For automatically issuing SSL certificates.
+  - `443/tcp`: To access the web UI.
+  - `51820/udp`: VPN traffic listen port.

 :::caution
 Before deploying Firezone in **production**, you'll need a valid DNS record
@@ -63,28 +62,38 @@ If the automatic install fails, or you'd just like more control over the
 installation process, follow the steps below to install manually.

 1. Download the docker compose template to a local working directory:
-**For Linux**:
+   **For Linux**:
+
 ```
 curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.prod.yml -o docker-compose.yml
 ```
+
 **For macOS, Windows (non-production only)**:
+
 ```
 curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.desktop.yml -o docker-compose.yml
 ```
+
 1. Generate required secrets:
+
 ```
 docker run --rm firezone/firezone bin/gen-env > .env
 ```
-1. At a minimum, change the `ADMIN_EMAIL` and `EXTERNAL_URL` variables.
-Optionally modify other secrets as needed.
+
+1. At a minimum, change the `DEFAULT_ADMIN_EMAIL` and `EXTERNAL_URL` variables.
+   Optionally modify other secrets as needed.
 1. Migrate the database:
+
 ```
 docker compose run --rm firezone bin/migrate
 ```
+
 1. Create the first admin:
+
 ```
 docker compose run --rm firezone bin/create-or-reset-admin
 ```
+
 1. Bring the services up: `docker compose up -d`

 You should now be able to access the Firezone web portal at the `EXTERNAL_URL`
@@ -108,6 +117,7 @@ By default, Firezone ships with IPv6 connectivity enabled inside the tunnel but
 to the public internet. To enable IPv6 support in Docker-deployed Firezone, follow the steps below.

 1. Enable IPv6 support within Docker by adding the following to `/etc/docker/daemon.json`:
+
 ```json
 {
  "ipv6": true,
@@ -116,15 +126,20 @@ to the public internet. To enable IPv6 support in Docker-deployed Firezone, foll
  "fixed-cidr-v6": "2001:db8:1::/64"
 }
 ```
-  This enables IPv6 NAT and configures IPv6 forwarding for Docker containers.
+
+This enables IPv6 NAT and configures IPv6 forwarding for Docker containers.
+
 1. Enable router advertisements on boot for your default egress interface:
+
 ```
 egress=`ip route show default 0.0.0.0/0 | grep -oP '(?<=dev ).*' | cut -f1 -d' ' | tr -d '\n'`
 sudo bash -c "echo net.ipv6.conf.${egress}.accept_ra=2 >> /etc/sysctl.conf"
 ```
+
 1. Reboot

 You should now be able to ping google from within a docker container:
+
 ```
 docker run --rm -t busybox ping6 -c 4 google.com
 ```
@@ -142,24 +157,24 @@ Firezone currently uses WireGuard's
 Once successfully deployed, users and devices can be added to
 connect to the VPN server:

-* [Add Users](../../user-guides/add-users):
-Add users to grant them access to your network.
-* [Client Instructions](../../user-guides/client-instructions):
-Instructions to establish a VPN session.
+- [Add Users](../../user-guides/add-users):
+  Add users to grant them access to your network.
+- [Client Instructions](../../user-guides/client-instructions):
+  Instructions to establish a VPN session.

-import SupportOptions from '@site/src/partials/_support_options.mdx';
-<SupportOptions />
+import SupportOptions from "@site/src/partials/_support_options.mdx";
+<SupportOptions />;

 ## Post Setup

 Congrats! You have completed the setup, but there's a lot more you can do with
 Firezone:

-* [Integrate your identity provider](../../authenticate/)
+- [Integrate your identity provider](../../authenticate/)
  for authenticating clients
-* Using Firezone as a NAT gateway to
+- Using Firezone as a NAT gateway to
  [establish a static IP for your team](../../user-guides/use-cases/nat-gateway)
-* Create tunnels between multiple peers with
+- Create tunnels between multiple peers with
  [reverse tunnels](../../user-guides/use-cases/reverse-tunnel)
-* Only route certain traffic through Firezone with
+- Only route certain traffic through Firezone with
  [split tunneling](../../user-guides/use-cases/split-tunnel)
--- a/www/docs/reference/rest-api/README.mdx
+++ b/www/docs/reference/rest-api/README.mdx
@@ -24,7 +24,7 @@ docker compose -f $HOME/.firezone/docker-compose.yml exec firezone bin/create-ap

 :::caution
 API tokens generated from the CLI are owned by the primary administrator specified by
-the `ADMIN_EMAIL` environment variable.
+the `DEFAULT_ADMIN_EMAIL` environment variable.
 :::

 ```mdx-code-block
--- a/www/docs/reference/reverse-proxy-templates/traefik.mdx
+++ b/www/docs/reference/reverse-proxy-templates/traefik.mdx
@@ -183,7 +183,7 @@ services:
      - ${HOME}/.firezone/firezone:/var/firezone
    environment:
      EXTERNAL_URL: ${EXTERNAL_URL:?err}
-      ADMIN_EMAIL: ${ADMIN_EMAIL:?err}
+      DEFAULT_ADMIN_EMAIL: ${DEFAULT_ADMIN_EMAIL:?err}
      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:?err}
      GUARDIAN_SECRET_KEY: ${GUARDIAN_SECRET_KEY:?err}
      SECRET_KEY_BASE: ${SECRET_KEY_BASE:?err}