diff --git a/opsimate-docs/docs/getting-started/configuration.md b/opsimate-docs/docs/getting-started/configuration.md index 20a1dc9..a2ab6ed 100644 --- a/opsimate-docs/docs/getting-started/configuration.md +++ b/opsimate-docs/docs/getting-started/configuration.md @@ -100,6 +100,13 @@ mailer: secure: false from: "OpsiMate " mailLinkBaseUrl: "https://opsimate.example.com" + # replyTo: "support@example.com" # optional Reply-To on every email + # tls: + # rejectUnauthorized: false # only for a self-signed certificate + # templates: + # welcomeTemplate: + # subject: "Welcome to OpsiMate!" # default subject of the welcome email + # content: "

Custom greeting here

" # replaces the greeting paragraph (HTML) auth: user: "your-smtp-username" pass: "your-smtp-password" @@ -107,6 +114,19 @@ mailer: Replace the example values with your SMTP provider's settings. Set `from` to a sender address your provider allows, and set `mailLinkBaseUrl` to the public URL of your OpsiMate frontend, without a trailing slash. Password-reset emails require this URL to build the reset link. +Four optional keys refine what is sent: + +| Key | What it does | Default | +| --- | --- | --- | +| `replyTo` | Reply-To address added to every email OpsiMate sends. Left out when unset. | unset | +| `tls.rejectUnauthorized` | Passed to the SMTP connection. With no `tls` section, Nodemailer's defaults apply and a certificate that cannot be verified is rejected. Set `false` **only** for an SMTP server with a self-signed certificate — it turns off certificate checking. | Nodemailer default | +| `templates.welcomeTemplate.subject` | Subject line of the welcome email. | `Welcome to OpsiMate!` | +| `templates.welcomeTemplate.content` | Replaces the greeting paragraph of the welcome email. Inserted as HTML, so plain text or simple HTML both work; the Documentation / Slack / GitHub links below the greeting are always kept. | the built-in greeting | + +The welcome email is sent once, when the **first admin** registers. Users an admin adds later in Settings → Users do not get one. + +All four keys are YAML-only: there is no environment variable for `replyTo`, `tls`, or the welcome template, just as there is none for `secure`. + Use `secure: false` with port 587 for STARTTLS, or `secure: true` with port 465 for TLS from the start, according to your provider's instructions. See the [Nodemailer SMTP options](https://nodemailer.com/smtp#general-options) for details. Email requires `enabled: true`, a host, a port, and both authentication fields. When a loaded YAML file enables email but omits any of those SMTP fields, OpsiMate disables email and logs a warning. Keep credentials out of version control, and restart the server after changing its configuration. @@ -125,7 +145,18 @@ When `CONFIG_FILE` is unset or points to a file that does not exist, the server | `SMTP_FROM` | Sender address, equivalent to `mailer.from`. | | `APP_BASE_URL` | Public frontend URL, equivalent to `mailer.mailLinkBaseUrl`. | -These variables do **not** override a loaded YAML configuration. If your deployment sets `CONFIG_FILE` to an existing file, configure `mailer` in that file instead. There is no SMTP environment variable for `secure`; use YAML when your provider requires `secure: true`. +These variables do **not** override a loaded YAML configuration. If your deployment sets `CONFIG_FILE` to an existing file, configure `mailer` in that file instead. There is no SMTP environment variable for `secure`; use YAML when your provider requires `secure: true`. The same goes for `replyTo`, `tls` and the welcome template: YAML-only. + +## Login + +A top-level `login.default_email_domain` key lets people sign in with a bare name: `dana` signs in as `dana@company.com`. A leading `@` in the value is ignored and the value is lower-cased. + +```yaml +login: + default_email_domain: "company.com" +``` + +When the key is not in the file, the server reads `LOGIN_DEFAULT_EMAIL_DOMAIN` from the environment, in either mode (YAML or environment-only). Unset means login takes the full email only. The same domain completes a bare `owner` name sent by an integration; see [configuration_example](https://github.com/OpsiMate/OpsiMate/blob/main/configuration_example/README.md). ### Check the Connection diff --git a/opsimate-docs/docs/user-management/register-login.md b/opsimate-docs/docs/user-management/register-login.md index 91bee53..04500ce 100644 --- a/opsimate-docs/docs/user-management/register-login.md +++ b/opsimate-docs/docs/user-management/register-login.md @@ -6,13 +6,13 @@ sidebar_position: 1 - OpsiMate provides secure user authentication. -## Registration +## First-run: creating the admin account -New users can register for OpsiMate access: +Registration is a first-run step, not a sign-up page. While no user exists, the app sends every visitor to `/register` and shows a **Create First Admin User** form (email, full name, password). The password needs at least 6 characters and no spaces. After it succeeds you are signed in straight away, and the account is an **Admin**. -1. Enter your email address -2. Create a secure password -3. Verify your email address +The first registration then closes: with any user present, `POST /api/v1/users/register` answers 403 "Registration is disabled after first admin". Everyone else is added by an admin in **Settings → Users → Add User**, or signs in through [directory login (LDAP)](./ldap.md) if that is set up. + +No email verification happens at any point. If the [mailer is configured](../getting-started/configuration.md#email-smtp-configuration), the new admin receives a one-time welcome email — that is the only welcome email OpsiMate sends.
OpsiMate Register @@ -21,11 +21,21 @@ New users can register for OpsiMate access: ## Login -Existing users can log in to access their dashboard: +Sign in with your email and password. A wrong email or password shows "Invalid email or password". + +If the server sets [`login.default_email_domain`](../getting-started/configuration.md#login), the field reads **Email or username** and a name without `@` signs in as `name@` — `dana` becomes `dana@company.com`. With LDAP on, directory users sign in here with their directory password; local accounts, including the first admin, keep signing in with their OpsiMate password. See [Directory login (LDAP)](./ldap.md). + +## Forgot password + +The **Forgot password?** link on the login page is shown only when email is enabled on the server, with [`mailLinkBaseUrl` set](../getting-started/configuration.md#email-smtp-configuration). + +1. Enter your email. The server sends a link to `/reset-password?token=…`, valid for **15 minutes**. +2. Choose a new password: at least 8 characters, no spaces, and different from your current one. +3. An expired or already-used link shows "This password reset link is no longer valid", with a button to request a new one. + +For an unknown email, or a directory (LDAP) account, the server sends nothing but answers exactly as if it had, so the page cannot be used to find out who has an account. -1. Go to the login page -2. Enter your email and password -3. Click "Sign In" to access your dashboard +To change your own password later, use **Profile → edit → Change Password (Optional)** (at least 6 characters). Directory accounts see a note that their password is managed by the directory instead.