hermes - 💡(How to fix) Fix OpenWebUI first-admin race when ENABLE_SIGNUP=true (default) + OPEN_WEBUI_HOST=0.0.0.0 (LAN bind) [1 pull requests]

Summary

scripts/setup_open_webui.sh defaults OPEN_WEBUI_ENABLE_SIGNUP=true. When the operator also sets OPEN_WEBUI_HOST=0.0.0.0 to expose OpenWebUI on the LAN, the first device to hit http://<lan-ip>:8080 claims the admin account. Any device on the LAN — including untrusted ones — can win this race during the install window.

Reproduction

OPEN_WEBUI_HOST=0.0.0.0 bash ~/.hermes/hermes-agent/scripts/setup_open_webui.sh

After OpenWebUI comes up, the first HTTP client to load the UI is granted admin (default ENABLE_SIGNUP=true behavior). On a multi-device LAN this is a race the operator cannot reliably win, especially on faster home/office networks with always-on devices.

Suggested fix (any of)

1. Default OPEN_WEBUI_ENABLE_SIGNUP=false and require the operator to flip it on explicitly after the admin account is created.
2. Add an --admin-email <addr> flag that pre-creates the admin user (or gates signup to that email).
3. Detect OPEN_WEBUI_HOST=0.0.0.0 (or any non-loopback bind) and refuse to proceed without one of:
   • OPEN_WEBUI_ENABLE_SIGNUP=false
   • --admin-email set
   • explicit --i-understand-lan-signup-race confirmation flag
4. At minimum, surface a loud warning in the setup script's terminal output: "OpenWebUI is binding to 0.0.0.0 with signup enabled — first LAN client to reach :8080 claims admin. Lock down signup or restrict bind to 127.0.0.1 first."

Affected file

scripts/setup_open_webui.sh:31 (per live grep on v0.15.2):

OPEN_WEBUI_ENABLE_SIGNUP="${OPEN_WEBUI_ENABLE_SIGNUP:-true}"

Environment

• Hermes Agent: v0.15.2
• Any multi-device LAN deployment of OpenWebUI via the setup script.