set default creds back to admin admin

.env.example

@@ -21,8 +21,8 @@
 # OVERLORD_USER=myadmin
 
 # OPTIONAL: Custom initial admin password
-# Leave empty to generate and persist to save.json
-# OVERLORD_PASS=
+# Default is "admin"
+# OVERLORD_PASS=admin
 
 # ============================================
 # OPTIONAL: Custom port

Overlord-Server/.env.example

@@ -10,8 +10,8 @@ HOST=0.0.0.0
 
 # Authentication
 OVERLORD_USER=admin
-# Leave empty to auto-generate and persist in ./data/save.json
-OVERLORD_PASS=
+# Default bootstrap password is "admin" unless you override it
+OVERLORD_PASS=admin
 
 # Optional overrides. Leave empty to auto-generate and persist in ./data/save.json
 JWT_SECRET=

Overlord-Server/src/config.ts

@@ -37,7 +37,7 @@ export interface Config {
 const DEFAULT_CONFIG: Config = {
   auth: {
     username: "admin",
-    password: "",
+    password: "admin",
     jwtSecret: "",
     agentToken: "",
   },
@@ -170,13 +170,6 @@ export function loadConfig(): Config {
     passwordFromConfig ||
     savedSecrets.auth?.bootstrapPassword ||
     DEFAULT_CONFIG.auth.password;
-  if (!finalBootstrapPassword) {
-    finalBootstrapPassword = generateRandomSecret(28);
-    saveChanged = true;
-    logger.info(
-      "No initial admin password provided, generated bootstrap password in save.json",
-    );
-  }
 
   const keywordsEnv = process.env.OVERLORD_NOTIFICATION_KEYWORDS;
   const keywordsFromEnv = keywordsEnv

Overlord-Server/src/users.ts

@@ -85,7 +85,7 @@ if (userCount.count === 0) {
     `[users] Bootstrap login credentials -> username: ${initialUsername} | password: ${initialPassword}`,
   );
   logger.warn(
-    "[users] ⚠️  SECURITY WARNING: Rotate the bootstrap password after first login. If it was auto-generated, retrieve it from data/save.json.",
+    "[users] SECURITY WARNING: Rotate the bootstrap password after first login. Default bootstrap credentials are admin/admin unless overridden by configuration.",
   );
 }
 

README.md

@@ -22,10 +22,12 @@ Overlord generates them and persists them to `data/save.json` (inside Docker:
 
 - JWT signing secret
 - Agent auth token
-- Initial admin bootstrap password
+
+Initial bootstrap login defaults to username `admin` and password `admin`
+unless overridden with `OVERLORD_USER` / `OVERLORD_PASS`.
 
 Keep `save.json` private and backed up. Use values from that file if you need
-to recover bootstrap access.
+to recover JWT or agent token values.
 
 to update run