First-run setup status + admin-form prefills

GET

/setup/status

• Local development behind nginx (port 8088 by default)

Returns whether the system still needs first-run setup, plus read-only deployment info (DB host/port, storage backend) and any prefill values the admin’s deploy environment provided via AA_SETUP_DEFAULT_* env vars. Anonymous access — this is the first thing a brand-new install renders.

Responses

200

Setup status + defaults

object

needs_setup

required

True when no user with the system.admin capability exists.

boolean

deployment

required

Read-only view of how the running process was configured at boot. Shown on the setup page so the admin can confirm the installation target before creating an admin account.

object

db_host

required

string

Example

postgres

db_port

required

integer

Example

5432

db_name

required

string

Example

artist_alley

storage_backend

required

Fs | s3

string

Example

fs

defaults

required

Prefills harvested from AA_SETUP_DEFAULT_* env vars at boot. Empty strings mean “no prefill”; the form leaves those fields blank.

object

admin_username

required

string

admin_email

required

string

admin_fullname

required

string

site_name

required

string

Example

artist-alley

site_base_url

required

string

smtp_host

required

string

smtp_port

required

integer

Example

587

smtp_encryption

required

string

Allowed values: none starttls tls

Example

starttls

smtp_username

required

string

smtp_from_address

required

string

public_mode

required

True when the install serves its public read surface to anonymous visitors. The frontend reads this to decide whether a signed-out visitor may stay on a public route or must be sent to the sign-in page; the server enforces the same setting independently, so this field is a rendering hint and never the access decision.

It rides on this endpoint because the frontend already calls it first on every navigation, before it knows whether a session exists — so the flag is available at the moment the routing decision is made, without a second request.

boolean

self_registration_enabled

required

True when the install accepts self-service signups. The frontend reads this to decide whether a signed-out visitor may reach /register and whether the sign-in page offers a “create an account” link; POST /auth/register enforces the same setting itself and refuses with 403 when it is off, so this field is a rendering hint and never the access decision.

Rides on this endpoint for the same reason public_mode does — the routing decision is made before a session is known to exist.

This is the ONLY part of the self-registration settings exposed here. This endpoint is unauthenticated, so the rest of the knob set (the email-verification requirement, the default role) stays on the admin-only auth settings surface.

boolean

500

Unexpected server error

object

error

required

Human-readable error summary

string

Example

the request could not be completed