First Login

2.5.1 First Login

replication-manager exposes two HTTP listeners that serve the dashboard and REST API. The one you use depends on your deployment topology:

Which URL to open

API server modes

When api-https-bind = true the API server enforces HTTPS — protected endpoints (/api/monitor, Swagger, cluster operations, alerts) are not served on the HTTP server (port 10001). Only unauthenticated endpoints (health, proxy checks, login) remain available on port 10001 in that mode.

Binding configuration

Reverse-proxy example (nginx):

server {
    listen 443 ssl;
    server_name repman.example.com;

    ssl_certificate     /etc/ssl/repman.crt;
    ssl_certificate_key /etc/ssl/repman.key;

    location / {
        proxy_pass http://127.0.0.1:10001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# replication-manager.toml
http-bind-address = "127.0.0.1"
http-port         = "10001"
api-https-bind    = true   # keep protected endpoints off the plain-HTTP port

2.5.2 Local Users

replication-manager ships with two built-in local accounts:

These accounts are defined by the api-credentials configuration key:

api-credentials = "admin:repman,dba:repman"

or via command-line flag:

replication-manager monitor --api-credentials "admin:repman,dba:repman"

Change the default passwords immediately after first login. Accounts using the default password repman trigger a cluster warning (see below).

2.5.3 Changing Passwords

Passwords can be changed from the Settings → Users panel in the GUI, or by updating api-credentials in the cluster TOML file and reloading.

Each entry in api-credentials follows the format username:password. Multiple accounts are separated by commas.

2.5.4 Default Password Warning — WARN0108

replication-manager continuously monitors whether the built-in accounts still use their default passwords. When either admin or dba retains the password repman, the cluster enters state:

WARN0108: Default users still use default password.
          Please change the credentials for users: (admin,dba)

This warning appears in the cluster dashboard and in the main HA log. It clears automatically once the passwords are updated.

The check is performed by CheckDefaultUser() on every monitoring tick — no restart is required after changing passwords.

2.5.5 SSO Login via gitlab.signal18.io

Once your instance is registered, users can log in using their gitlab.signal18.io identity instead of a local password. SSO login does not require a local api-credentials entry — authentication is handled by the Signal18 GitLab OAuth flow.

To log in with SSO:

1. Click Sign in with GitLab on the replication-manager login page
2. Authenticate at gitlab.signal18.io (your Signal18 SSO account)
3. replication-manager validates your identity against the GitLab group membership for your registered instance namespace

The role and grants assigned to an SSO user are managed entirely through the replication-manager GUI and API — not through GitLab group roles. See Cluster Role Sharing for the full role and grant model.

2.5.6 Summary