Required security settings
The signing key, pepper, bootstrap password, webhook token and cookie settings, and how to verify them on the System diagnostics screen
Required permission: Global admin
Geo-MLOps starts even without a configuration file, because the signing keys and passwords have default values for convenient development. If you keep those defaults in a production installation, anyone can forge a session or sign in as the administrator. Compose silently starts with the defaults even if /etc/geo-mlops/app.env is missing or renamed, so "it starts fine" does not mean it is safe. Check the System diagnostics screen right after installation and after every deployment.
Five settings you must change
Setting (after GEO_MLOPS_) | If left at the default | Action |
|---|---|---|
AUTH_SECRET | CRITICAL — anyone can forge session JWTs and password reset tokens | Replace with an openssl rand -hex 32 value |
EDGE_TOKEN_PEPPER | CRITICAL — the edge, MLflow and registry token hashes all use this value | Replace with an openssl rand -hex 32 value (different from AUTH_SECRET) |
RBAC_BOOTSTRAP_ADMIN_PASSWORD | CRITICAL — the first administrator's password is a value everyone knows | Change it to a strong password, or change the password after the first sign-in and empty this value |
ALERTMANAGER_WEBHOOK_TOKEN | WARNING — the alert webhook is closed with 503 and alerts do not reach the app (setting a value opens it) | Set a random value and put the same value in the monitoring/alertmanager.yml header |
AUTH_COOKIE_SECURE | Default true. Setting it to false gives a WARNING — the session cookie also travels over plain HTTP | Keep true if users connect over HTTPS |
For how to enter the values, see the app.env example in Install with Docker Compose. After editing, recreate the app so it reads them.
docker compose -f /opt/geo-mlops/docker-compose.yml up -d appBootstrap administrator password
The bootstrap administrator is created from RBAC_BOOTSTRAP_ADMIN_PASSWORD only once, when the account does not exist. After that, changing this value does not change the account's password. So we recommend this order.
- Before the first start, put a temporary password in
RBAC_BOOTSTRAP_ADMIN_PASSWORDand start the stack. - Sign in with that account and change to the real password under the avatar menu at the top right → Account settings (계정 설정) → Change password (비밀번호 변경).
- Empty it in
app.env(RBAC_BOOTSTRAP_ADMIN_PASSWORD=) and recreate the app. The value now creates no account, and the diagnostics warning disappears.
If you forget the password, you can create a new administrator on the server with the admin CLI.
docker exec -it geo-mlops-app ./run geo-mlops-admin user create ops@example.com --admin
# without --password, it generates and prints a random passwordOther things the diagnostics screen checks
| Setting | Verdict | Meaning |
|---|---|---|
RBAC_BOOTSTRAP_ROLE_PASSWORD | WARNING | Per-role demo accounts are created with a default password. In production, empty it to turn this off |
CORS_ALLOW_ORIGINS is * | WARNING | Combines credentials (cookies) with a wildcard. Specify the web UI's address |
MLFLOW_REQUIRE_AUTH=false | CRITICAL | /mlflow is open without sign-in. Keep the default true |
MOCK_DATAOPS_ENABLED=true | WARNING | A fake DataOps server for development. Turn it off in production (off by default) |
Verify on the System diagnostics screen
Global admin Only global administrators can see it. The screen does not show the setting values themselves, only "is it the same as the default".
-
Sign in as the global administrator and press System (시스템) at the top right to open the system console. If the System diagnostics (시스템 진단) card has a "Needs attention (진단 주의 필요)" badge, there is something to fix.
System console — where a global administrator starts -
Open System diagnostics (시스템 진단). At the top, "Deployment info (배포 정보)" shows the commits of the backend and frontend now running, and "Dependencies (의존 컴포넌트)" shows the connection state of Postgres, the object store, Kubernetes, MLflow and so on.
System diagnostics — deployment info, configuration hygiene, dependencies -
Under "Configuration hygiene (설정 위생)", fix things according to the tables above until no CRITICAL remains. Each item names the environment variable to change.
Configuration hygiene — a signing key, pepper and passwords left at their defaults show as CRITICAL
The screenshot above shows an installation started with the defaults. The signing key, pepper and administrator password show as CRITICAL, and as long as they remain, the overall verdict stays at "Needs attention (주의 필요)" — even when every connection is healthy. Being connected and being safe are different things.