Initial setup
The first visit to the panel asks you to choose a username and a password — credentials live hashed on your server, never in a config file.
The setup wizard
The first time you open vuzon in a browser it asks you to choose a username and a password (twice). They are stored on your server as a scrypt hash in the vuzon-data volume — there is no AUTH_PASS variable, and the password never exists in plain text anywhere.
Finish the setup right away. Until you do, the panel has no owner, so anyone who can reach it could claim it — the same trust-on-first-use model as Uptime Kuma or Nextcloud. The server repeats that warning in its log on every boot while it is unconfigured.
Sessions
Login uses a signed vuzon_session cookie; the signing key is generated by the panel itself, inside the data volume. Logging out invalidates the cookie on the server, not just the browser copy — a cookie captured earlier stops working. Login is rate-limited to 10 attempts / 15 min, and credentials are compared in constant time.
Changing your credentials
To change your username or password later, use the key icon in the panel header. If you lose the vuzon-data volume you lose the password too: the setup wizard reopens on the next visit — see Backups.
Choosing a good password
- Minimum 12 characters; pick something long and unique.
- If the panel is reachable from the internet, serve it over TLS and set
COOKIE_SECURE=1— see Reverse proxy & TLS.