Sign-up, invite links and a first-run onboarding checklist

niklas commented

2026-09-20 05:59:27 +00:00

Owner

Part of #1. Depends on teams, roles and the admin page (sign-up mode is an admin setting). Best done last, since it's the front door to everything else.

Today

The first user comes from POST /api/bootstrap, called by the Helm post-install Job (charts/terdut-server/templates/bootstrap-job.yaml), which stores the result in a Secret.
After that users are created by other users, with no invites and no self-service.
The login page tells people to "ask an admin".
Nothing in the app explains how to point Alertmanager at terdut.

Scope

Sign-up

Sign-up mode setting: open or invite-only, defaulting to invite-only. No email-domain mode — there is no email to verify addresses with.
POST /api/signup: creates the account, then creates a team (open mode) or joins the invite's team.
Rate-limit it the way login already is (internal/api/auth.go).
The bootstrap Job stays, and creates the first system admin plus the default team.

Invites

An invites table: token hash, team, role, created by, expiry, single- or multi-use, redeemed at.
Team owners create invite links for their team; admins can invite to any team.
A redeem page for a signed-out visitor (sign up and join) and for a signed-in user (just join).
Invites are copy-paste links. No email is sent.

Onboarding checklist (shown on first sign-in, dismissable, resumable)

Set your ntfy topic and send a test push.
Put yourself on a schedule.
Create an integration and copy its URL.
Send a test alert, and confirm in the UI when the first one arrives.

Integration instructions

An in-app page per integration kind, starting with Alertmanager: a ready-to-paste receiver config with the team's own URL filled in.
A generic curl example for a smoke test.
Room for Grafana and others later.

Done when

Someone with an invite link can go from nothing to a real page on their phone without an admin touching anything, and a fresh install with the Job still comes up with one admin and one team.

Part of #1. Depends on teams, roles and the admin page (sign-up mode is an admin setting). Best done last, since it's the front door to everything else. ### Today - The first user comes from `POST /api/bootstrap`, called by the Helm post-install Job (`charts/terdut-server/templates/bootstrap-job.yaml`), which stores the result in a Secret. - After that users are created by other users, with no invites and no self-service. - The login page tells people to "ask an admin". - Nothing in the app explains how to point Alertmanager at terdut. ### Scope **Sign-up** - [ ] Sign-up mode setting: `open` or `invite-only`, defaulting to `invite-only`. No email-domain mode — there is no email to verify addresses with. - [ ] `POST /api/signup`: creates the account, then creates a team (open mode) or joins the invite's team. - [ ] Rate-limit it the way login already is (`internal/api/auth.go`). - [ ] The bootstrap Job stays, and creates the first system admin plus the default team. **Invites** - [ ] An `invites` table: token hash, team, role, created by, expiry, single- or multi-use, redeemed at. - [ ] Team owners create invite links for their team; admins can invite to any team. - [ ] A redeem page for a signed-out visitor (sign up and join) and for a signed-in user (just join). - [ ] Invites are copy-paste links. No email is sent. **Onboarding checklist** (shown on first sign-in, dismissable, resumable) - [ ] Set your ntfy topic and send a test push. - [ ] Put yourself on a schedule. - [ ] Create an integration and copy its URL. - [ ] Send a test alert, and confirm in the UI when the first one arrives. **Integration instructions** - [ ] An in-app page per integration kind, starting with Alertmanager: a ready-to-paste receiver config with the team's own URL filled in. - [ ] A generic curl example for a smoke test. - [ ] Room for Grafana and others later. ### Done when Someone with an invite link can go from nothing to a real page on their phone without an admin touching anything, and a fresh install with the Job still comes up with one admin and one team.