First login & initial configuration

First login

After installation, the server listens over HTTPS on https://<ip-du-serveur>:8443 with a self-signed certificate. The procedure below is done only once, and entirely from the uVersion desktop client. Allow five minutes.

1. Retrieve the initial password

The installer shows it at the end of the run, along with the admin account it belongs to, and reminds you that it is single-use.

If you did not note it down, it stays readable on the server machine:

If you moved the data directory, replace /var/lib/uversion with your path: this file is written next to the data, and its location is derived from [storage].path in config.toml.

2. Sign in from the desktop client

The https:// is imposed and is not typed: only the machine address and the port remain, 8443 by default. Then the admin user and the password retrieved in step 1.

3. Confirm the server fingerprint

Instead of signing you in, the client opens a Verify server identity window that displays the certificate fingerprint and asks you to compare it with the one communicated by the administrator. Here the administrator is you: the three ways to find this fingerprint on the server are on TLS fingerprint. Once Trust this server is confirmed, the connection resumes on its own, and this window will not come back on this workstation.

4. Change the password

The initial password must be changed immediately: the client opens a dedicated page that forces you to do it before letting you see anything else. The current password is asked again, and the new one is at least eight characters long.

The change revokes the current session: you are sent back to the sign-in screen to identify yourself with the new password. This is normal.

The server then automatically deletes the initial-admin-password file (no manual action required). If it remains, the change has not yet been made.

5. Create the team accounts

Still in the desktop client: Admin in the sidebar, Users tab, Create User button. Each account receives a role at creation, and it is this role that decides what it can do: see Users. The password you enter here is communicated to the person, who then changes it from their own settings.

Next steps

• Share the TLS fingerprint with the team, so each workstation confirms it: TLS fingerprint
• Create your first repository: Create a repository
• Give your team access: Permissions
• Enable the validation rules, shipped disabled: Validation rules

Updating the server

When a new version is published, the administration panel of the desktop client shows an Update now button. One click is enough: the server downloads the new package, verifies it, installs it and restarts. The interruption is brief, your data and your database are not touched, and the migrations apply at startup (the server updates its own database structure by itself).

What "verifies" covers exactly, and it is not the same thing on both sides:

• Linux (.deb): the server reads the publication manifest over HTTPS, finds in it the package address and its SHA-256 checksum, downloads that precise package and refuses to install it if the checksum does not match. There is no signature: trust rests on the HTTPS with which the manifest and the package are fetched.
• Windows, via the button: the server fetches install.ps1 over HTTPS and runs it in update mode. In this mode, the script has no local archive next to it: it announces that it skips signature verification and relies on the HTTPS of the download.
• Windows, by hand: if you run install.ps1 from an archive you extracted, the script looks for a detached RSA-4096 signature next to the archive (and downloads it if it is missing), then verifies it with openssl. Two cases where it continues anyway, saying so: the original archive is not found, or openssl is not installed on the machine. Installing Git for Windows, which bundles openssl, is enough to activate this verification.

This checksum verifies a downloaded file. It has nothing to do with the server fingerprint, which identifies your server's certificate and which your clients pin: two notions, two uses, and it is this shared word that confuses everyone.

In a container, the server cannot replace its own image: the button says so and points to the Docker procedure (docker compose pull then up -d).

By hand, if you prefer: simply reinstall the most recent package, with the same command as at installation (apt install ./uversion-server_*.deb or install.ps1). The installer reuses your configuration and your licence.