First-time setup

Edition: Community and Enterprise Offering: Self-managed

The setup wizard takes a new installation from nothing to its first governed fix, in the browser. It lists eight steps, each with where your installation stands, so you can leave and come back at any time.

Prerequisites:

• sealfix is installed and running behind your TLS proxy.
• You know the bootstrap administrator's password.

Sign in at /login/local. This break-glass page is linked from nowhere, and every use of it is recorded and reported to the administrators and auditors. While a required step is open, it lands on the wizard; afterwards the wizard stays under "Admin" > "Setup".

flowchart LR
    S1["1 Administrator"] --> S2["2 Directory"] --> S3["3 Who does what"] --> S4["4 Executor key"]
    S4 --> S5["5 First target"] --> S6["6 Policies"] --> S7["7 Integrations<br/>optional"] --> S8["8 Summary"]
    classDef req fill:#DCE3EE,stroke:#13202D,stroke-width:2px,color:#13202D
    classDef opt fill:#E9EEF6,stroke:#23407A,color:#13202D
    class S1,S2,S3,S4,S5,S6,S8 req
    class S7 opt

Step	What you do
1. Administrator	Nothing: shows who you are signed in as.
2. Directory	Enter the LDAP URL, base DN and filter. "Look up a user" shows the account and its groups as the directory returns them. Save, then restart api and executor.
3. Who does what	Bind each directory group to a role, everywhere or for one project. Bind the administrators' group last.
4. Executor key	Nothing: shows the id of the public key every value is sealed to.
5. First target	Add your database and run the connection test: the executor checks the connection, its privileges, and where the database could record a bound value.
6. Policies	Choose a preset. "Regulated (recommended)", the default: production needs a DBA reviewer, a business approver and a ticket, inside a weekly window. The other preset, "Every environment: DBA and business, a ticket", asks for both approvals and a ticket in every environment.
7. Integrations	Optional: notifications, single sign-on, Git, SIEM.
8. Summary	Every step shows its state. Restart once more if System health asks for it.

The wizard keeps no secret

A field that needs a secret takes a reference: the name of an environment variable, or the path of a file. A value that looks like a secret is refused and never shown back.

Every step is saved as a new configuration version or a role binding, and recorded in the audit log.

After the setup

When your administrators can sign in through the directory, unset SEALFIX_ADMIN_PASSWORD_HASH and restart the API, or keep the bootstrap account for emergencies and limit /login/local to your administration network (auth.break_glass_networks).

Troubleshooting

My directory users can sign in but see nothing

They have no role yet. Bind their groups in step 3.

System health says Restart needed

Each process reads the configuration when it starts. Restart the processes it names: docker compose restart api executor.

sealfix refuses a role binding

A binding that would let one person both administer and approve, or change their own access, is always refused.