Vaulthalla LogoVaulthalla

First Run

After installing on Linux or macOS - sign in, secure the admin account, confirm CLI access, serve HTTPS, create a vault and set up recovery.

First Run

After installation, a few steps turn a fresh install into one you can rely on: secure the built-in admin account, confirm that vh works from your account, put the console behind HTTPS, create a vault, and set up recovery material before important data goes in.

Checklist

  1. Confirm the service is healthy

    1vh status

    vh status exits 0 when healthy, 1 degraded, 2 critical. If vh can't connect, see CLI Access below.

  2. Sign in and change the admin password

    Each install generates its own admin password and keeps a plaintext copy readable only by root. Sign in with it, then change it (or keep it and delete the file).

  3. Confirm CLI access

    Run vh from your own account, not with sudo.

  4. Serve the console over HTTPS

    nginx on Linux, Caddy on macOS.

  5. Create a vault and export its keys

    Local Vaults or S3 And R2 Vaults, then Backup And Recovery.

Sign In

1sudo cat /var/lib/vaulthalla/super_admin_initial_password

Open http://<host>/ (through the nginx site the package set up) and sign in as admin.

Then change the password from the account bound to admin:

1vh setup set-super-admin-password

It asks for the new password and removes the plaintext copy. More about signing in, password policy and the console's areas: Web Console.

CLI Access

vh talks to the daemon over a local socket that only members of the service's group can open, and maps each caller to a Vaulthalla user by uid.

The socket is /run/vaulthalla/cli.sock and the group is vaulthalla. If the installer didn't enroll you:

1sudo usermod -aG vaulthalla "$USER"2newgrp vaulthalla3vh setup assign-admin

vh setup assign-admin binds admin to your Linux UID when it is still unbound. Until someone claims it, the first non-root user to reach the socket can. Details: CLI Access on Linux.

Day-to-day commands (vh vault, vh user, vh api-key, vh vault sync) need no sudo. Only lifecycle commands do: CLI Guide.

Database

The package bootstraps a local PostgreSQL database when one is installed and healthy. If you skipped it (VH_SKIP_DB_BOOTSTRAP=1) or use a remote database:

1sudo vh setup db2sudo vh setup remote-db --host db.example.com --port 5432 --user vaulthalla \3  --database vaulthalla --password-file /root/vaulthalla-db-password

See Local PostgreSQL Bootstrap.

Next Steps