First-Run Setup
QUBIQ ships with no default account. There is no admin/admin to forget to change: the first
super administrator is created by you, once, through the setup wizard.
Creating the super administrator
Open http://localhost:8182. Because no super admin exists yet, QUBIQ shows the setup wizard
instead of the login screen.
Fill in:
| Field | Rules |
|---|---|
| Username | Required. This is the login name. |
| Required, must be a valid address. Used for account recovery and audit attribution. | |
| Password | 8–128 characters. |
| Confirm password | Must match. |
Submit, and QUBIQ creates the account, signs you in and lands you in the Platform.
Or: rebuild this gateway from a backup
On a replacement machine, the wizard can restore a full-instance backup instead of creating an account. Click Rebuilding this gateway? Restore a backup instead under the form; the subtitle changes to Rebuild this gateway from a backup.
| Field | |
|---|---|
| Backup file | A full-instance .qbak. |
| Passphrase | Only if the backup was encrypted. |
Restore & continue takes the instance's entire configuration — including its user accounts — from the archive. No account is created here: you sign in afterwards with an administrator from the backup, not with a password chosen on this machine.
When the restore succeeds, the wizard goes straight to the sign-in page, and the restored installation is complete without a restart: views, scripts, playbooks and specialists are searchable, and older playbook checks are converted to this build's shape, exactly as after a restore from Settings. 1.0.8 In 1.0.7 the wizard stayed on screen over the sign-in page until the browser was refreshed, and the restored content was not searchable until the next boot.
A restore that is refused — a wrong passphrase, or an archive newer than this build — leaves the wizard where it is. A successful one closes setup exactly as creating an account does. → Backup & restore
The wizard is reachable only until it has been used, and that is now recorded permanently: a completion mark is written both to the configuration database and to a file in the data directory, and either one alone refuses a second setup. Emptying the user table does not reopen it.
Changed in 1.0.4If the machine is network-reachable during installation, complete this step immediately.
What the super administrator can do
The first account holds every permission, including the ones that are deliberately super-admin-only:
- Manage Permissions — change which role may call which endpoint
- Manage Audit — configure the tamper-evident audit journal
- Manage Backup & Restore — export and restore configuration backups
- Manage LiveView Auth — bind projects to runtime identity sources
Create narrower accounts for day-to-day work rather than sharing this one. → Users and roles
Recommended next steps
Work through these in order — each is a prerequisite for the next.
1. Create additional accounts
The User Management card in Settings → Security Policy. Give engineers a role that can design
but not administer, and reserve the super admin for permission and audit changes. → Users and roles
2. Configure history storage
The historian needs a QuestDB connection — QuestDB 9.4.0 or later — and exactly one connection is designated as the historian. Without it, live values work and nothing is retained. → Historian configuration
3. Configure the audit journal
The security audit journal writes to an external SQL database (Postgres, MySQL or SQL Server) — never the app's own database, so that a compromise of QUBIQ cannot rewrite its own history. → Audit journal
4. Take a baseline backup
Export a configuration backup now, while the system is clean, so you have a known-good restore point. → Backup & restore
The Python runtime is bundled by the installer and already wired up. Add extra modules later from
Settings → Script Sandbox if your scripts need them.
→ The script sandbox
Recovering a lost super administrator
There is no back door and no vendor master password. What there is, is a console command — run on the server, by somebody who can read its data directory:
qubiq admin list-admins
qubiq admin reset-password --user jhalloran
It prints a temporary password once, requires that account to choose a new one at next sign-in, ends every session it had, and records the reset three ways — the system log, the audit journal, and a security notice administrators can see for a week. New in 1.0.4
→ Console recovery for the full procedure, including the confirmation step and what the reset leaves behind.
The other two paths still work and are worth knowing:
- Restore a backup into a fresh installation — the backup carries the user table.
- Start over — install fresh against an empty data directory, and the wizard reappears. (This does not buy a fresh trial: the licence records a consumed trial outside the data directory as well as inside it.)
It used to work, and it was a hole rather than a feature: anyone who could write to the configuration database could empty the user table and mint themselves a super admin through a public, unauthenticated endpoint, leaving no trace. Setup is now one-shot, and the reset command above is what replaces it.