Skip to main content

First run

Use this checklist immediately after Jiandu starts.

1. Find the owner recovery token​

On first full startup, Jiandu creates a 256-bit token in an owner-only file and reports that file's path. For the source default it is:

server/jiandu-data/owner-access-token

The token is not a normal password. Keep it as offline break-glass recovery material.

2. Claim the installation​

Open Jiandu from the configured origin. What you do next depends on how people sign in.

No human account yet. This is the default: the configuration starts without an external identity provider or a pre-existing human. While the installation is unclaimed, the sign-in page offers Create the first account. Enter your name, a username and password, and the recovery token, and Jiandu creates the account, makes it Administrator, and opens Settings. To do the same from a terminal without displaying the token, use the secret-safe Compose bootstrap helper for the reviewed Compose evaluation, or run ./scripts/bootstrap-local-account.sh from the repository root while the default source launcher is ready.

An account that already signs in. For OIDC, LDAP, or trusted-proxy admission, configure and verify that provider first. Then sign in with the human account that should administer the installation and, when Jiandu says the setup is unclaimed, enter the recovery token.

Either way, a successful claim grants that account the built-in Administrator role; it does not consume or attach the Owner token.

3. Add a sample document​

Use a non-sensitive PDF or image. Confirm that you can:

  • open the original;
  • correct its title or other filing information;
  • find it again by browsing or search;
  • download the preserved original and open it outside Jiandu.

4. Make the first backup​

Do this before inviting other people or importing a large collection. Then restore into a new, empty destination and open a sample document from the restored installation. The promoted Compose topology has an executable isolated drill; other deployments must follow the same-backend procedure in backup and restore.

5. Review exposure​

If another device needs access, set up HTTPS and an explicit reverse-proxy boundary. Never work around the loopback default by publishing the application port as plaintext. See reverse proxy and HTTPS.

Last updated on