Skip to content
DiscVaultDiscVault Docs

Install: Legacy Authentication

Goal and result

Section titled “Goal and result”

Configure the implemented DiscVault 26 beta username/password fallback with TOTP, recovery codes, and fail-closed activation.

Applies to

Section titled “Applies to”

Legacy Authentication is an optional DiscVault 26 beta capability. Fresh instances with no users or credentials can atomically bootstrap the first Owner after password-risk acknowledgement; existing installations activate password login in Users & roles with a fresh Owner or Admin passkey assertion. Passwords require at least 15 characters and Argon2id storage. TOTP and single-use recovery codes are the recommended fallback path. Only a direct private or loopback request with invalid or empty RP settings may explicitly opt out of TOTP during first-owner bootstrap.

DiscVault v26 beta

Section titled “DiscVault v26 beta”
  • DiscVault v26 beta · ghcr.io/helmerznl/discvault:beta
  • optional username + password + TOTP capability
  • Passkeys remain preferred when a valid FQDN and trusted HTTPS are available

Prerequisites

Section titled “Prerequisites”
  • Legacy Authentication with a username, password, and two-factor authentication (2FA) is available in DiscVault 26 beta as a fallback when passkeys cannot be used.
  • owner access · on a brand-new instance with no users or credentials, the setup wizard atomically creates the first Owner after password-risk acknowledgement
  • TOTP · recovery codes are hashed, single-use, and shared with passkey recovery; backups omit TOTP secrets and recovery material, so MFA users enroll again after restore

Legacy Authentication fallback

Section titled “Legacy Authentication fallback”

Procedure

Section titled “Procedure”
  1. Configure: LEGACY_AUTH_ENABLED=true · with a valid FQDN, keep RP_ID and RP_ORIGINS aligned and use trusted HTTPS
  2. Configure: RP_ID= · RP_ORIGINS= · for a direct private or loopback IP without an FQDN, leave RP_ID and RP_ORIGINS empty
  3. Choose: on a brand-new instance with no users or credentials, the setup wizard atomically creates the first Owner after password-risk acknowledgement · on an existing installation, enable password login in Users & roles and approve activation with a fresh Owner or Admin passkey assertion
  4. Create: passwords require at least 15 characters, cannot equal the username or a denied common password, and are hashed with Argon2id; five failures in 15 minutes lock the account for 15 minutes · TOTP · recovery codes are hashed, single-use, and shared with passkey recovery; backups omit TOTP secrets and recovery material, so MFA users enroll again after restore
  5. Configure: Owners and Admins can issue temporary passwords, require a password change, set per-user MFA policy, and control passkey registration
  6. Test: Legacy Authentication with a username, password, and two-factor authentication (2FA) is available in DiscVault 26 beta as a fallback when passkeys cannot be used. · GET /api/next/auth/status
  7. Record: recovery codes are hashed, single-use, and shared with passkey recovery; backups omit TOTP secrets and recovery material, so MFA users enroll again after restore

Commands and settings

Section titled “Commands and settings”

DiscVault v26 beta

Section titled “DiscVault v26 beta”
RP_ID=discvault.example.com
RP_NAME=DiscVault
RP_ORIGINS=https://discvault.example.com
LEGACY_AUTH_ENABLED=true
RP_ID=
RP_NAME=DiscVault
RP_ORIGINS=
LEGACY_AUTH_ENABLED=true
Terminal window
curl --fail http://localhost:6180/api/next/health
curl --fail http://localhost:6180/api/next/auth/status

Expected result

Section titled “Expected result”

The first or existing Owner can authenticate with a policy-compliant password and TOTP, recovery codes are acknowledged and stored offline, and account lockout works after repeated failures.

  • Legacy Authentication with a username, password, and two-factor authentication (2FA) is available in DiscVault 26 beta as a fallback when passkeys cannot be used.
  • TOTP · recovery codes are hashed, single-use, and shared with passkey recovery; backups omit TOTP secrets and recovery material, so MFA users enroll again after restore
  • passwords require at least 15 characters, cannot equal the username or a denied common password, and are hashed with Argon2id; five failures in 15 minutes lock the account for 15 minutes

Safety and rollback

Section titled “Safety and rollback”

Next step

Section titled “Next step”

Install: First start and health check

Source and status

Section titled “Source and status”