{% extends 'layouts/base.html' %}{% block content %}
<div class="note mb-4">Keep recovery access until the named account has signed in successfully. No AIM or operating-system accounts are created here.</div>
<div class="workflow-grid">
<section class="card"><div class="card-body p-4"><p class="eyebrow">01 / CREATE</p><h2 class="h4">Create your named administrator</h2><p class="text-secondary">Choose a personal username and a temporary passphrase. First login requires a password change.</p>
<form action="/setup" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="create">
<label class="form-label" for="setup-name">Personal username</label><input id="setup-name" name="username" class="form-control mb-3" pattern="[a-z][a-z0-9._-]{2,63}" required autocomplete="off">
<label class="form-label" for="setup-password">Temporary passphrase (15-128 characters)</label><input id="setup-password" type="password" name="password" class="form-control mb-3" minlength="15" maxlength="128" autocomplete="new-password" required>
<label class="form-label" for="setup-confirm">Confirm temporary passphrase</label><input id="setup-confirm" type="password" name="confirm" class="form-control mb-3" minlength="15" maxlength="128" autocomplete="new-password" required>
<button class="btn btn-primary" type="submit">Create named administrator</button></form></div></section>
<section class="card"><div class="card-body p-4"><p class="eyebrow">02 / VERIFY &amp; RETIRE</p><h2 class="h4">Retire the bootstrap account</h2><p>Sign out, sign in with your new account, replace its temporary password, then return here.</p><p>Only a named administrator with a permanent password can disable the bootstrap account. Existing bootstrap sessions are revoked.</p>
<form action="/setup" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="retire"><button class="btn btn-outline-primary" type="submit" {% if session.username == 'admin' or not setup.ready %}disabled{% endif %}>Disable bootstrap admin</button></form>
<p class="form-text mt-3">Local recovery remains available through <code>aim-web user</code> under the service identity.</p></div></section></div>
{% endblock %}