Recovering access
There is no forgot-password flow in Slick, on purpose. A self-hosted instance may have no mail relay configured at all, and a reset link is only ever as trustworthy as the mailbox it lands in. What the person running the server does have is a shell on the machine, so that is where the recovery path lives.
Resetting a password
Section titled “Resetting a password”It prompts, without echoing, and then:
- replaces the password hash, using the same Argon2id path as signup
- signs out every existing session for that account, which is the point when the reason for the reset is that someone else got in
In Docker:
The -it matters. Without it there is no terminal to prompt on, and the
command will tell you so rather than hanging.
Scripting it
Section titled “Scripting it”The password is never accepted as an argument. Arguments are visible to any
other process through ps and land in shell history, which is a poor place
for a credential to sit.
Finding the account
Section titled “Finding the account”If you are not sure which address the account uses, ask the database:
sqlite3 data/slick.db 'select email, display_name from users'Bot accounts appear here too, with @slick.invalid addresses. They have no
usable password by design, so resetting one does nothing useful. Revoke and
recreate the bot from Workspace settings instead.
If the owner account is gone entirely
Section titled “If the owner account is gone entirely”Ownership cannot currently be transferred from the command line. If the only owner account has been deleted, promote another member to owner directly:
sqlite3 data/slick.db \ "update workspace_members set role='owner' where user_id=(select id from users where email='[email protected]')"Take a backup first. Editing the database by hand is a last resort, not a routine.