Disable Signup

By default anyone who can reach your instance can create an account on it. For an instance on the open internet that is rarely what you want, so signup can be switched off:

NUXT_PUBLIC_SIGNUP=false

With it off, the sign-up form is gone from the login screen and the endpoint behind it answers 403. Bots that find your domain get nowhere.

You can still let people in

Turning signup off does not mean creating every account by hand. Two routes stay open, and both put you in charge of who joins:

• Invite them to a board. Type an e-mail address into a board's Permissions dialog and that address is sent a link that creates the account and joins the board in one step. The link works once, expires after 14 days, and only works for the address it was sent to. See Boards.
• Create the account yourself. Admins can add users directly in the users screen — see Users.

That is the arrangement most instances want: nobody signs themselves up, but anyone who is invited can get in without an administrator typing their password for them.

The first administrator

An instance with signup disabled and no accounts is a locked door with no key, so set the first administrator from the environment:

NUXT_ADMIN_EMAIL=you@example.com
NUXT_ADMIN_PASSWORD=a-long-password

See Users for how that behaves — briefly: it only acts when there is no administrator at all, and it never overwrites an existing password.