Secure by default
Some apps have one or two settings that catch people out, like open sign-ups. LibrePortal asks about them once, at install, with the safe answer already picked.
On this page
Most people press Install and never open an app's settings. That's fine for most apps. A few, though, have one setting that matters a great deal and is easy to miss: who is allowed to make an account, say, or whether a second step is asked for at sign-in. Left open, those are the doors strangers use.
So LibrePortal asks about them at the one moment you're already looking: the install. The safe choice is already picked, and you can press Next without thinking about it.
The Quick settings step#
When an app has settings like that, its install dialog gets one extra step, Quick settings, after the app's own questions and before Extras and Confirm. It has a few switches, each with an icon and one short line saying what it does. An app with nothing risky to ask about doesn't get the step at all.
- The safe answer is already chosen and marked Recommended.
- Choosing the riskier answer shows one line saying what it means, in warning colour. For example, switching on Open sign-ups in Vaultwarden says anyone who can reach the vault can make an account on your server.
- Confirm repeats it. The last step before Install has a Settings row that says Recommended when every switch is safe, and spells out each one that isn't, so a risky choice is the last thing you read.
Why not just leave it on the Config tab?
Because that's where people don't look. An app that's open to sign-ups from the day it's installed is open to anyone who finds its address. Asking once, at install, costs a tap. Finding out later costs more.
Changing it later#
These switches aren't a second copy of anything. They're the same settings as on the app's Config tab. Change one there and the install step shows the new value next time. The step appears when you install or reinstall an app, and not when you press Update Configuration, where the Config tab is already open in front of you.
What the common switches mean#
Open sign-ups. Whether anyone who can open the app's page can make their own account. Closed means only you add people, which is almost always what you want for something that runs on your own server. Where an app needs a way to let someone in, it has a tool for it: Vaultwarden has Invite Someone on its Tools tab, which needs no mail server, and in Vikunja you add people from inside the app. Open it only for an app you want strangers to join.
Require 2-step sign-in. Authelia's switch, on by default and marked Recommended. After the password, each person gives a code, a passkey or a security key. A stolen password alone then isn't enough to get into any app behind Authelia. See Two-step sign-in.
Who can reach it. Whether an app's web page is Public (anyone who can reach your server) or Private (your trusted places and VPN devices only) is its own choice, shown on the Confirm step. Private is the recommended answer unless the app needs outsiders. It isn't a Quick settings switch, because every app has it. Who can reach what explains it, including how to make Private the starting answer for every new app.
It all works on a plain address
Nothing here needs a domain. Closed sign-ups and Private apps are exactly what you want for a server you reach at http://192.168.1.50:port or over the LibrePortal VPN.
What "secure by default" covers#
Quick settings are the part you can see. Under them, LibrePortal already follows a few rules for every app, which Security goes through: no default passwords, and no app that the first visitor can claim. Apps whose sign-ups would otherwise be open start closed, and apps that can't be closed are kept out of reach until their admin account exists.
Apps you already have#
LibrePortal never changes a setting on an existing install behind your back. When a switch is added to an app you've already installed, it starts with the value that app has today, so nothing changes until you decide. If you'd like the safer answer, open the app's Config tab and change it.
To check: which apps have a Quick settings step in 0.7.0 (today: Authelia, Vaultwarden, Vikunja; more are being added in waves), and whether the Security check line on an existing app's page has shipped