get-started: docs: declare the first user

docs/src/get-started/first-project.md

@@ -7,11 +7,34 @@ A flake built by Gradient, with the outputs in a binary cache.
 - A running instance, see [Quick Start](quick-start.md) or [Standalone](standalone.md)
 - A flake in a Git repository the server can reach
 
-## 1. Register
+## 1. First User
 
-Open `https://gradient.example.com/account/register` and create the first user.
+=== "UI"
 
-The server will refuse registration with `registration.enable = false` or `oidc.required`. Sign in through OIDC instead, or declare the first user in [`services.gradient.state.users`](../reference/state.md#usersname).
+    Open `https://gradient.example.com/account/register` and create the first user.
+
+    The server will refuse registration with `registration.enable = false` or `oidc.required`. Use the declarative tab or sign in through OIDC then.
+
+=== "Declarative"
+
+    ```sh
+    install -d -m 700 /var/lib/gradient-secrets
+    gradient hash > /var/lib/gradient-secrets/admin-password # (1)!
+    ```
+
+    1.  Password prompt twice, then an argon2id hash as output. The [CLI](../reference/cli.md#install) page lists the install steps.
+
+    ```nix
+    services.gradient.state.users.admin = {
+      email = "admin@example.com";
+      password_file = "/var/lib/gradient-secrets/admin-password"; # (1)!
+      superuser = true;
+    };
+    ```
+
+    1.  The file contains the hash, not the password. A plaintext password in it would make the server fail on start.
+
+    Sign in as `admin` with the password. Registration can stay off. Other user options are in [Declarative State](../concepts/declarative-state.md).
 
 ## 2. Create a Cache
 

docs/src/get-started/installation.md

@@ -92,7 +92,7 @@ Root can keep ownership of the files. The server will read them as systemd crede
 
 ## 4. Reverse Proxy and TLS
 
-The server will handle the API, the worker protocol and the cache. A reverse proxy in front will deliver the web frontend and TLS.
+The server will handle the API, the worker protocol and the cache. A reverse proxy in front will deliver the web frontend and TLS. The server listens on `127.0.0.1:3000`, and `services.gradient.port` can change the port.
 
 === "nginx (default)"
 

docs/src/get-started/quick-start.md

@@ -61,7 +61,7 @@ openssl rand -base64 48 > /var/lib/gradient-secrets/crypt
 }
 ```
 
-1.  An nginx virtual host from the module, answering on this domain.
+1.  An nginx virtual host from the module, answering on this domain. Only set it to false if you know what you are doing.
 2.  A local PostgreSQL database for Gradient.
 3.  A worker on the same host, self-registering and joining every project.
 4.  Gradient needs PostgreSQL 18 or newer. The NixOS default may be older.