# Install Flow and sign in the first time

> Run Flow with Node.js or Docker, open it on port 8000, sign in with the login and password that Flow generates at the first start, and know which folders hold your data.

Framework: flow
Product: Flow (flow@11.1)
Language: en
Content-SHA256: 5a25bf52b53d52c97ea7dadedbcef824b1f3079740fe72fe4ebfdade8152bb6b
Snapshot: c0700e321579725c5cf4f5ace1ad7d2866d1b4f93c24a63c0b41b6b7998e976c
Sources: 
Review: not-recorded

## Run it with Node.js

Flow needs Node.js and nothing else: no database, no external service.

```bash
git clone https://github.com/totaljs/flow.git
cd flow
npm install
npm run start
```

`npm run start` runs `node index.js 8000`. The port is optional on the command line and the default is `8000`, so you open `http://localhost:8000`. Add `--release` to run in release mode.

## Run it with Docker

```bash
docker pull totalplatform/flow
docker run -p 8000:8000 totalplatform/flow
```

The `docker-compose.yaml` of the repository maps port 8000 and keeps two volumes: the folder `databases` (settings and the user) and the folder `flowstream` (your streams). Keep those two volumes and you can replace the container whenever you update.

## The first sign-in

At the first start Flow creates the only user of the application with a **random login and a random password**. Until the first successful sign-in, the sign-in page shows them in a box (*Default account*) with a button **Fill in the form**: click it and sign in. From that moment Flow deletes the plain copy of the password from its preferences and the box no longer appears, so open the password form of the application right away and set a login and a password of your own. Do the first sign-in as soon as you start a new installation, before anyone else can reach the address.

Some details of the sign-in, read from the source:

- The password is stored as a SHA-256 hash with the `cookie_secret` of the installation as the salt, and the session is a cookie of one month encrypted with the same secret. Flow generates the cookie name and the secret the first time and keeps them in `databases/config.json`.
- After repeated failed attempts an address is blocked (the block is cleared every 15 minutes).
- When the settings hold the tokens of an OpenPlatform (`op_reqtoken`, `op_restoken`), the sign-in page is replaced by the sign-in of that [OpenPlatform](/en/openplatform/how-an-app-connects/) and the permissions *Create Flows* and *Remove Flows* control who may create and remove streams.

## Where the data lives

| Folder | What it holds |
|---|---|
| `databases/` | `config.json` (cookie name and secret) and `memorize_preferences.json` (name, tokens, the user, the `env`, the URLs of the components) |
| `flowstream/` | `database.json` with every FlowStream: its design, components, variables and notes |
| `private/` | files that the streams write and that you can list with the token of Flow |
| `public/cdn/` | cache of the user-interface components that Flow downloads the first time they are needed |

To move Flow to another machine, copy `databases/` and `flowstream/`.

## Update

Download the new version of the repository (the file `version` tells you which one you run: `11.1` in the revision documented here) or pull the new Docker image and start it with the same volumes.