FluxDeployDocs
Topics: First-Run Setup

First-Run Setup

When FluxDeploy starts for the first time with no admin password configured, all browser requests are redirected to the /setup page. This forces you to establish initial security before the system becomes usable.

Setup Wizard

Screenshot: First-run setup wizard

The setup page collects three pieces of information:

  1. Server Address (required) - The hostname and port where the server is reachable. Enter the hostname or IP address and the HTTPS port (default 443). This is stored as a full URL (e.g., https://deploy-server.corp.local) and is used for:

    • Boot image builds (embedded in the agent configuration)
    • Relay site relay.json generation
    • PXE boot file provisioning

  2. Admin Password (required) - Minimum 8 characters. This password is hashed using PBKDF2-SHA256 with a random 16-byte salt and 100,000 iterations. Once set, the admin password cannot be removed - only changed via Settings > Security.

  3. Organization Name (optional) - Displayed in the UI header and reports.

Important: The setup page is rate-limited to 5 attempts per 15 minutes to prevent brute-force attacks during initial configuration.

Restoring from a Previous Installation

If you are rebuilding a server, open Restoring from a previous installation? on the setup page before you create the admin account. It asks for the two backup files: the settings backup (.json, choose it from this server or upload it) and the assets backup folder (ISOs, Windows images and manually uploaded drivers). Each is optional, and the page says in plain words what you lose by leaving one out. The two are checked together and refused if they do not belong to the same backup. The assets go back first, then the settings, and any drivers you had downloaded from a vendor catalog download again in the background. See Backup & Restore.

After Setup

After submitting the setup form, you are redirected to the /login page. Enter the admin password you just set to access the dashboard.

Technical note: The redirect to /login (rather than auto-login) is required because Blazor Server cannot set HTTP cookies after the initial render - the response has already started over the SignalR WebSocket connection.

What Happens Behind the Scenes

  • The FirstRunSetupMiddleware intercepts all requests and redirects to /setup until an admin password exists in the database
  • Agent endpoints (/api/deployment, /api/pxe, /api/relay) are excluded from the redirect so deployments can work even during setup
  • SignalR hubs and Blazor framework paths are also excluded

Relay Servers

Relay servers skip the setup wizard entirely. The admin password is synced from the Core server during the first heartbeat cycle. No manual password configuration is needed on relays.

Next Steps

After logging in, proceed to:

  1. Configure organization settings in Settings > General
  2. Upload Windows ISOs to the ISO Library
  3. Create a custom Windows image
  4. Set up a deployment recipe
  5. Build a boot image for PXE or USB deployment