First owner and users

One server is one organisation. This page shows how to make the first user, how to let other people in, and how to help a user who lost the master password.

Make the first owner

Start the server

Start lasboltd and put the proxy in front. See Install.

Register in the web app

Open https://<your server>/register. Type a username and a master password twice. The browser makes the keys. The server never gets the password.

The first user is the owner. This works with every registration mode, because the server has no user yet.

Check it

sudo -u lasbolt lasboltctl users list

USERNAME  ROLE   STATUS  LAST SEEN         DEVICES
owner1    owner  active  2026-10-21 12:26  1

Make a recovery kit

Tell the owner to make a recovery kit in Settings › Security › Recovery kit. See Recovery.

After the first user, new people need an invitation. The default registration mode is invite.

Roles

Role	What the role can do
`owner`	Everything an admin can do. Also: make or remove owners, disable or delete an owner, set the registration to `open`.
`admin`	Invite members and admins. Change `member` and `admin` roles. Disable, enable and delete members and admins. Set the registration to `closed` or `invite`. Revoke invitations.
`member`	A normal user. No admin rights.

A role gives no access to the content of anyone. An admin manages accounts, not items.

These rules always hold:

There is always at least one enabled owner. The server refuses to remove the last one.
Nobody can disable or delete their own account.
An admin function works only from a web session or an app that signed in with the master password. The lasbolt CLI and the browser extensions have no admin rights.

Registration modes

Mode	Who can register
`closed`	Nobody. Invitations still work.
`invite`	A person with an invitation. This is the default after the first user.
`open`	Anyone who can reach the server. Only an owner can set it.

Set the mode in Settings › Organisation, or on the host:

sudo -u lasbolt lasboltctl registration show
sudo -u lasbolt lasboltctl registration set invite

Use open only for a short time, on a server that is not public. The server logs a warning at each start while the mode is open.

The old flag --allow-registration sets the mode to open one time, when the setting has no value. After that, the setting rules and the flag does nothing. Remove the flag from new installs.

Invite a person

In the web app: Settings › Organisation › Invite. Choose a role and how long the link works (1, 7 or 30 days). The dialog shows the link and a QR code one time. The server keeps only a hash of the token, so it cannot show the link again.

On the host:

sudo -u lasbolt lasboltctl invite create --role member --expires 7d

Invitation aad04907aa6424e803ab8fc074dd0a61 for a member. The link works once and ends 2026-10-28 11:26.
https://vault.example.org/register?invite=<token>

The link goes to stdout and the details go to stderr, so a script can take the link. Set --public-url on the server, or add --base-url to the command, so that the link has your address. Send the link on a channel that you trust. It works once.

List and revoke open invitations:

sudo -u lasbolt lasboltctl invite list
sudo -u lasbolt lasboltctl invite revoke <id>

An invitation that is wrong, used, revoked or too old gives one message, so the page does not tell which. The server rate-limits the checks of invitation tokens for each address.

Disable, enable and delete a user

Disable. The user cannot log in. All sessions, devices and keys of the user stop at once. Use Settings › Organisation › Manage, or:
```
sudo -u lasbolt lasboltctl users disable alice
```
Enable. The user can log in again with the same master password. Revoked devices and keys do not come back. The user signs in again.
```
sudo -u lasbolt lasboltctl users enable alice
```
Delete. In Settings › Organisation › Manage, choose Delete account and type the username. The account is disabled now and removed after a grace period (30 days by default). You can cancel before that. A shared space with other members stays.

lasboltctl has no delete command. Delete in the web app.

Add an owner

If the last owner is lost, you can make an existing user an owner from the host:

sudo -u lasbolt lasboltctl owner add alice

This is the break-glass. Every lasboltctl command is in the audit log with the principal “Server operator (lasboltctl)”.

A user lost the master password

Ask for the recovery kit

A user who made a recovery kit selects “Forgot your master password?” on the login page and types the username and the code. Nothing is lost. You do nothing.

Reset from the host (no kit)

sudo -u lasbolt sh -c 'set -a; . /etc/lasbolt/lasboltd.env; set +a; exec lasboltd user reset-password alice --url https://vault.example.org'

The command prints a link that works once and ends after one hour. Use the same data folder as the server. The command needs no unseal secret, and the server can run while you use it. A new link replaces the old one.

Give the link to the user

Use a channel that you trust. The page warns the user before the reset.

A reset makes new user keys. End-to-end encrypted folders of the old keys stay locked for ever. Nobody can open them again, also not you. The user keeps server-readable spaces and the folders that are not end-to-end encrypted.

What the reset does:

Item	Result
Master password	The user sets a new one.
Key pairs	New ones. The old end-to-end folders cannot be opened.
Web sessions, devices, CLI sessions	All end. The CLI says `key_mismatch` until the user runs `lasbolt logout` and `lasbolt login`.
Scoped keys	All end.
Recovery kit	Deleted. The user makes a new one.
Two-factor authentication	Stays as it was.
Shared spaces	The user stays a member. The other members see a changed key. An admin of the space re-adds the new keys after a safety number check.
Audit log	The user sees “password reset by the operator”.

A user with a recovery kit loses nothing if the user uses the kit and not the reset. Tell the user so before you reset.

Last updated on 2026-10-21

Configuration Backups and restore