From 67323752ccf0f6671f890cced35c8fad7b934969 Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Fri, 6 Mar 2026 14:45:15 -0600
Subject: [PATCH] set default creds back to admin admin

---
 .env.example                  | 4 ++--
 Overlord-Server/.env.example  | 4 ++--
 Overlord-Server/src/config.ts | 9 +--------
 Overlord-Server/src/users.ts  | 2 +-
 README.md                     | 6 ++++--
 5 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/.env.example b/.env.example
index 298c3ca..1259043 100644
--- a/.env.example
+++ b/.env.example
@@ -21,8 +21,8 @@
 # OVERLORD_USER=myadmin
 
 # OPTIONAL: Custom initial admin password
-# Leave empty to generate and persist to save.json
-# OVERLORD_PASS=
+# Default is "admin"
+# OVERLORD_PASS=admin
 
 # ============================================
 # OPTIONAL: Custom port
diff --git a/Overlord-Server/.env.example b/Overlord-Server/.env.example
index 0b1c67b..d849dab 100644
--- a/Overlord-Server/.env.example
+++ b/Overlord-Server/.env.example
@@ -10,8 +10,8 @@ HOST=0.0.0.0
 
 # Authentication
 OVERLORD_USER=admin
-# Leave empty to auto-generate and persist in ./data/save.json
-OVERLORD_PASS=
+# Default bootstrap password is "admin" unless you override it
+OVERLORD_PASS=admin
 
 # Optional overrides. Leave empty to auto-generate and persist in ./data/save.json
 JWT_SECRET=
diff --git a/Overlord-Server/src/config.ts b/Overlord-Server/src/config.ts
index 99c3c60..9506780 100644
--- a/Overlord-Server/src/config.ts
+++ b/Overlord-Server/src/config.ts
@@ -37,7 +37,7 @@ export interface Config {
 const DEFAULT_CONFIG: Config = {
   auth: {
     username: "admin",
-    password: "",
+    password: "admin",
     jwtSecret: "",
     agentToken: "",
   },
@@ -170,13 +170,6 @@ export function loadConfig(): Config {
     passwordFromConfig ||
     savedSecrets.auth?.bootstrapPassword ||
     DEFAULT_CONFIG.auth.password;
-  if (!finalBootstrapPassword) {
-    finalBootstrapPassword = generateRandomSecret(28);
-    saveChanged = true;
-    logger.info(
-      "No initial admin password provided, generated bootstrap password in save.json",
-    );
-  }
 
   const keywordsEnv = process.env.OVERLORD_NOTIFICATION_KEYWORDS;
   const keywordsFromEnv = keywordsEnv
diff --git a/Overlord-Server/src/users.ts b/Overlord-Server/src/users.ts
index 1249016..4ec0c99 100644
--- a/Overlord-Server/src/users.ts
+++ b/Overlord-Server/src/users.ts
@@ -85,7 +85,7 @@ if (userCount.count === 0) {
     `[users] Bootstrap login credentials -> username: ${initialUsername} | password: ${initialPassword}`,
   );
   logger.warn(
-    "[users] ⚠️  SECURITY WARNING: Rotate the bootstrap password after first login. If it was auto-generated, retrieve it from data/save.json.",
+    "[users] SECURITY WARNING: Rotate the bootstrap password after first login. Default bootstrap credentials are admin/admin unless overridden by configuration.",
   );
 }
 
diff --git a/README.md b/README.md
index 80b4092..2cd1734 100644
--- a/README.md
+++ b/README.md
@@ -22,10 +22,12 @@ Overlord generates them and persists them to `data/save.json` (inside Docker:
 
 - JWT signing secret
 - Agent auth token
-- Initial admin bootstrap password
+
+Initial bootstrap login defaults to username `admin` and password `admin`
+unless overridden with `OVERLORD_USER` / `OVERLORD_PASS`.
 
 Keep `save.json` private and backed up. Use values from that file if you need
-to recover bootstrap access.
+to recover JWT or agent token values.
 
 to update run