Signing in

1. Open the address the installer printed, such as https://203.0.113.10:7443.
2. Your browser warns that the connection is not private. That is expected: the server made its own certificate during installation. Continue past it.
3. Type your username and password and press Continue.
4. Set up an authenticator app when asked, then type the six digit code.
5. Save the recovery codes it shows you. They are shown once and never again.

Any authenticator works: Google Authenticator, Microsoft Authenticator, 1Password, Aegis or anything else that scans a standard code.

1. Open the app and choose to add an account.
2. Point it at the square code on screen.
3. Type the six digit number it starts showing.

If the phone cannot scan, type the line of characters underneath the code into the app by hand. It is the same thing in a different form.

Sign in with a recovery code instead of a six digit code. Each one works once. Then go to My Account and set up your new phone from there.

Nobody inside the software can help, because the software is the thing you cannot reach. Somebody with root on any node runs this:

sudo docker exec nginx-fleet-manager \
  python -m app.reset_admin --list

sudo docker exec nginx-fleet-manager \
  python -m app.reset_admin alice --reset-totp

Every use is written to the audit log as coming from the console, which is exactly the sort of thing that should stand out later.

My Account, then Recovery codes. Making a new set cancels every old code immediately, including any you have written down. Do it when you are down to one or two, and save the new list before you close the page.

While the old phone still works: go to My Account and set up the new one from there. You get a fresh code to scan, and the old phone stops working once you confirm.

If the old phone is already gone, sign in with a recovery code first, then do the same thing.

My Account. You need your current password as well as the new one. Changing it ends your other sessions, so a browser you left signed in somewhere else stops working. That is deliberate, and it is the quickest thing to do if you think somebody else has your password.

My Account lists your sessions. If you see something you do not recognize, change your password, which ends all of them at once, and tell whoever looks after security where you work.

You are almost certainly looking at the standby node. Changes are made on the active one. Check the top right of the screen for which node you are on, and open the other one.

Put a site in front of it, the same way you would any other application.

1. Make a pool with one member: 127.0.0.1 port 7443. Turn on TLS and turn off certificate verification, since it uses its own self signed certificate and the traffic never leaves the box.
2. Add NFM_ROOT_PATH=/lb to .env and restart the container, so every link it writes includes the prefix.
3. Make a site for lb-01.example.com with a path of /lb pointing at that pool. Leave the strip prefix setting off.
4. Get a certificate for that name and turn on https.

Keep the allowlist set to your office networks. The name being public and the screen being reachable are two different things.

There is no single button for it. Turning an account off ends that person's sessions immediately. For everybody, restarting the manager container on each node clears sessions across the fleet.