archy/.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md

created, title, area, severity, files

created	title	area	severity	files
2026-07-30T22:19:31.770Z	Fedimint gateway must not install with a pre-set password	security	blocker	core/archipelago/src (app orchestrator / secrets materialisation)

Problem

Dorian reports (2026-07-30): the Fedimint gateway app installs with a password already set up — i.e. a default/pre-baked credential rather than one generated at install time or set by the user. Default credentials on a Lightning/fedimint gateway are a security hole: anyone knowing the shipped default can access the gateway. Dorian rated this a blocker.

This also violates the repo's standing secrets invariant (CLAUDE.md): secrets must be manifest-declared (generated_secrets, materialised by container::secrets, 0600/rootless) — never hardcoded or per-app baked in.

Solution

Tracked as requirement FED-07 (Phase 1, ROADMAP success criterion 7 — needs a gap plan since phase 1's 10 plans predate it):

• Find where the fedimint gateway app's manifest/install path sets its password (check /opt/archipelago/apps/*/manifest.yml for the gateway, and the orchestrator's secrets materialisation).
• Move it to generated_secrets so each install gets a unique credential, or require explicit user setup.
• Migration path for existing installs still carrying the default password (migrations must never destroy data).