Trestle
First-run setup

Choose the database, then create the administrator.

A fresh Trestle deployment separates database readiness from administrator credentials. There is no default password or permanent setup credential.

SQLite flow

  1. Start Trestle and open its loopback dashboard.
  2. Keep SQLite selected. It is embedded, so no connection step is required.
  3. Enter the administrator email and a password of at least 7 characters.
  4. Trestle hashes the password with Argon2id, commits exactly one administrator and closes setup.

PostgreSQL flow

  1. Create an empty PostgreSQL 16, 17 or 18 database and a least-privilege Trestle role.
  2. Select PostgreSQL and enter its connection URL. Administrator fields stay hidden while the database is unverified.
  3. Choose Test and use PostgreSQL. Trestle connects within the configured timeout, verifies the server, and stores the bootstrap configuration in the owner-only data directory.
  4. Restart Trestle as instructed. The configured PostgreSQL provider initializes and validates its migration history before administrator fields appear.
  5. Create the administrator. The database selection controls are then permanently closed for this deployment.
postgres://trestle:CHANGE_ME@db.internal:5432/trestle?sslmode=require

For environment-managed secrets, configure TRESTLE_DATABASE_PROVIDER=postgres and TRESTLE_DATABASE_URL before starting instead of persisting a URL through the browser. See PostgreSQL configuration.

Race behavior

Setup checks and insertion occur inside one database transaction, and competing requests create exactly one administrator on both providers. SQLite serializes through its owned connection; PostgreSQL takes a transaction-scoped advisory lock. Losers receive a stable 409 setup_complete response.

Interrupted setup

A crash after PostgreSQL selection but before administrator creation leaves a resumable incomplete setup. After restart, Trestle re-establishes the provider connection and validates migration history before reopening administrator creation. Once an administrator commits, setup never reopens.

Exposure boundary

Complete setup over loopback or reviewed HTTPS. When a reverse proxy is used, bind Trestle privately, configure the exact trusted proxy CIDR, preserve Host and replace forwarded headers at the edge.