Adds an env-var that lets self-host operators on trusted networks
(Unraid behind a firewall, Tailscale-only deployments, homelabs)
claim the first admin via the web UI without copying a bootstrap
token out of the container logs.
Behavior when PAD_BYPASS_SETUP_TOKEN=true:
- handleBootstrap accepts non-loopback first-admin POSTs without an
X-Bootstrap-Token header. The UserCount==0 invariant is unchanged,
so the bypass auto-closes the moment the first admin claims the
seat (subsequent bootstrap requests get 409 regardless of bypass).
- handleSessionCheck returns setup_method=open so the /setup page
skips the paste-token UI and renders the form directly.
- Token generation is skipped at startup (no .bootstrap-token file
written). A distinct WARN-flavored banner makes the open-mode
trade-off obvious in operator logs.
- Cloud mode (PAD_CLOUD/PAD_MODE=cloud) ignores the flag entirely.
Three layers of defense: cmd/pad masks the env-var with
!cfg.IsCloudServer(), Server.openBootstrapEnabled() checks
!s.cloudMode, and the cloud branch in handleBootstrap never reads
the bypass field.
Unraid template gets a new "Bypass Setup Token" field (default false,
Display="always") with a description that calls out the trust-the-
network trade-off.
Tests pin all the security-critical contracts: bypass admits non-
loopback, bypass off keeps existing 403, cloud mode hard-ignores,
loopback works either way, post-bootstrap gate stays closed, bypass
wins over logs_token in session payload, cloud mode never advertises
'open' setup method.
Codex review: CLEAN (round 1).
One-time bootstrap token generated on first start with no users in self-host
mode. Token is logged in a banner the operator can grab from `docker logs`,
persists at <DataDir>/.bootstrap-token (mode 0600), and bypasses the
loopback-only gate via the X-Bootstrap-Token header — letting the user
claim the first admin from a remote browser at /setup#token=<x>.
Header-only contract + URL-fragment (browser-only, never transmitted) +
log-redaction middleware keeps the secret out of access logs, proxy logs,
and browser history. Cloud mode unchanged: token never loaded, never
honored. Validate → UserCount-check → CreateUser → consume sequence is
mutex-serialized to prevent concurrent valid-token requests from creating
multiple admins.
Part of PLAN-1166 (Pad on Unraid — Community Apps launch).
xarmian