Skip to main content

First Boot

The first time the GEM server starts it bootstraps itself. Understanding what happens makes the first login — and any troubleshooting — straightforward.

What happens on first start​

  1. Encryption key — if .encryption_key doesn't exist, GEM generates one. See Configuration for why you must back this up.
  2. Database schema — GEM ensures its tables exist in the gem schema.
  3. Attribute registry — GEM seeds its catalog of attribute definitions (the metadata describing every attribute's type, defaults, and options).
  4. Default users and roles — if no administrator exists yet, GEM creates the initial accounts described below.

Default accounts​

On first boot GEM creates two roles and two users:

AccountRolePurpose
adminadmin (full access)The administrator account you use to configure the system.
uiui (everything except /admin*)A shared account for wall-mounted touchpanel UIs.

Administrator credentials​

  • If the installer provided admin credentials, those are used.
  • Otherwise GEM falls back to username admin / password Gem123!, and flags the account so you must change the password at first login.
Change the default password immediately

The fallback password is well known and is forced to rotate on first use. Don't leave a production system on it. After logging in, set a strong administrator password.

Touchpanel account PIN​

The ui touchpanel account is seeded with a randomly generated 6-digit PIN, printed once to the server log during first boot:

generated ui panel pin (record this now, shown once): 481907

Record it then — the stored PIN is encrypted at rest and cannot be read back. If you miss it, set a new one from Security → Users → ui.

To seed a specific PIN instead (scripted or reproducible installs), set ui.pin in gem.json before first boot.

Upgrading from an earlier version

Systems first provisioned before this change were seeded with the fixed PIN 1234. Upgrading does not rotate it — that would lock out every wall panel already using it. Change it from Security → Users → ui at your next site visit.

The ui account's sessions last 30 days, after which the panel prompts for its PIN again.

First login​

  1. Browse to http://<server-ip>:3000 (see Installation → Verify).
  2. Log in as admin with the configured (or fallback) password.
  3. If prompted, set a new administrator password.

You're now ready to commission hardware — continue to the Quick Start.