Admin sits behind a 6-digit PIN #1

2026-09-16T18:58:53-04:00

michael commented

2026-09-16 18:58:53 -04:00

The passcode machinery was already there and every admin route already honoured it, but it could only be set by hand in a config file — so in practice both machines have admin wide open to anyone on the network. This makes it a PIN you set from the admin page.

Six digits, stored as a scrypt hash in that machine s proddash.json. The PIN itself is never written down.
The unlock card submits itself on the sixth digit. Five wrong tries from one address locks it out for 30 s; comparison is constant-time.
Changing or clearing it asks for the current PIN, so a browser left open on the admin page cannot be used to take the machine over.
It guards /admin and the admin API only. Dashboards stay open, and it is separate from a module PIN such as Slack s send PIN.
Way back in: PRODDASH_PASSCODE in the environment, or delete adminPin and restart.

Main was merged in to clear a conflict: the forge work and the PIN work each documented a new setting in the same two places. Everything from both sides is kept, and both features were verified working together on the merged branch.

The passcode machinery was already there and every admin route already honoured it, but it could only be set by hand in a config file — so in practice both machines have admin wide open to anyone on the network. This makes it a PIN you set from the admin page. - Six digits, stored as a scrypt hash in that machine s proddash.json. The PIN itself is never written down. - The unlock card submits itself on the sixth digit. Five wrong tries from one address locks it out for 30 s; comparison is constant-time. - Changing or clearing it asks for the current PIN, so a browser left open on the admin page cannot be used to take the machine over. - It guards /admin and the admin API only. Dashboards stay open, and it is separate from a module PIN such as Slack s send PIN. - Way back in: PRODDASH_PASSCODE in the environment, or delete adminPin and restart. Main was merged in to clear a conflict: the forge work and the PIN work each documented a new setting in the same two places. Everything from both sides is kept, and both features were verified working together on the merged branch.

michael added 2 commits 2026-09-16 18:58:54 -04:00

Admin sits behind a 6-digit PIN 6dabd9d8a1

The passcode machinery existed but could only be set by hand in a config
file, so in practice every install left admin open to anyone on the
network. It is now a PIN you set from the admin page itself.

- Six digits, stored as a scrypt hash in this machine's proddash.json —
  never in the clear, since that file gets copied between machines.
- The unlock card takes the PIN and submits itself on the sixth digit.
  Five wrong tries from one address locks it out for 30 seconds, and the
  right PIN is refused during the lockout.
- Changing or turning off the PIN asks for the current one, so a browser
  left open on the admin page cannot be used to take the machine over.
  Whoever sets it keeps their session rather than being bounced to the
  card they just built.
- This is the shell's own PIN and guards /admin and the admin API only.
  Dashboards stay open, and it is unrelated to a module's PIN — Slack's
  4-8 digit send PIN still guards sending, separately and independently.
- Ways back in if it is forgotten: PRODDASH_PASSCODE in the environment
  (which overrides the PIN), or delete adminPin from proddash.json and
  restart. Both are in the README and on the page itself.
- The older free-text adminPasscode still works, so an existing install
  keeps running.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Merge main into the admin PIN branch 7690ae1fad

Both sides added to the same two places — the environment-variable list in
server.js and the settings table in the README — because the forge work and
the PIN work each documented a new setting. Everything from both is kept.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

michael added 1 commit 2026-09-16 18:59:00 -04:00

Merge main into the admin PIN branch 7690ae1fad

Both sides added to the same two places — the environment-variable list in
server.js and the settings table in the README — because the forge work and
the PIN work each documented a new setting. Everything from both is kept.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

michael merged commit 7a5b57dc56 into main

2026-09-17 12:40:35 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: michael/ProdDash#1