Correct production operator username guidance

2026-08-01 13:35:55 +02:00
parent d1356aeed9
commit be38e9a99f
4 changed files with 38 additions and 4 deletions
@@ -12140,3 +12140,29 @@ Open:

 - The proof state becomes complete only after real QA evidence exists. A spatial
  selection result without QA deliberately remains “awaiting verification”.
+
+## 2026-08-01 - Production operator username correction
+
+### Root cause and correction
+
+- Traced the failed operator login to an exact username mismatch: the active
+  Tower runtime was configured as `jens@itworx.tech`, while the required
+  operator username is `ITWorx`. Authentication intentionally performs an
+  exact, case-sensitive comparison.
+- Backed up the persistent production `.env`, changed only
+  `GEOINTEL_AUTH_USERNAME` to `ITWorx`, and retained the existing PBKDF2
+  password hash, session secret, session lifetime and guest-access setting.
+- Updated the operator-configuration examples to use `ITWorx`, preventing the
+  former email-style example from being copied back into production.
+
+### Deployment and verification
+
+- Restarted the release from `/mnt/user/appdata/geointel` with
+  `DEPLOY_GEOINTEL_INSTALL_AI=true`; the existing immutable NVIDIA/AI image
+  `geointel-all-in-one:b18e8460da32-wipb6567ba06f10-ai` was preserved.
+- The container became healthy. PostGIS 3.6, required runtime schema objects,
+  Alembic head `202607260001`, frontend, API proxy and icon checks passed.
+- Confirmed the active container exposes authentication as enabled with exact
+  username `ITWorx`; no plaintext password or password hash was printed or changed.
+- Targeted backend authentication suite passed from the backend root: 8 tests.
+- `bash -n scripts/configure_operator_login.sh` and `git diff --check` passed.