Locked out? Recover your account

Forgot the password you sign in with, or lost your authenticator app and its backup codes? You can reset it yourself with the server's database password or recovery key (from the recovery kit you saved during first setup). Don't have either? Ask whoever runs your Budvo server: they can give you a temporary password from Settings, This server.

The database secret is what proves the server is yours. Recovery checks it against the encrypted database's keyring, exactly like unlocking the server does, so knowing an email isn't enough to take over an account.

On the sign-in page

1. Choose Forgot password? under the password, or Lost your authenticator? on the two-factor step.
2. Enter your email and the database password or the recovery key. The recovery key looks like XXXX-XXXX-XXXX-...; capitals and dashes don't matter.
3. Choose a new password and type it again.
4. Turn on Also remove my passkeys only if the devices that hold them are lost.
5. Choose Reset password.

You're signed in with the new password. Two-factor is off: turn it back on in Settings, Security and save the new backup codes. If you used the recovery key, Budvo offers to make a new one (Settings, This server, Recovery key), since you typed it into a browser. That's up to you.

The iPhone app has the same Forgot password? link when your server offers it.

For the account, recovery from the sign-in page:

• sets the password you chose,
• turns off two-factor and deletes the backup codes,
• removes passkeys, only if you asked,
• signs the account out on every browser and device,
• writes "recovered with the recovery key from the web" (or "the database password") and your address to the audit log,
• shows the person a notice the next time they sign in, until they dismiss it.

If you host friends, this works for their accounts too: whoever has the recovery key owns the server and could read everything anyway. The notice and the audit log make sure it's never silent.

To turn it off, set BUDVO_WEB_RECOVERY=false. The command line below keeps working.

From the command line

Needs a terminal on the machine running Budvo, with access to Docker, and the same database password or recovery key.

docker exec -it budvo budvo-server recover

1. Type the database password or the recovery key. Nothing shows while you type, and it's never stored or logged.
2. Pick your account from the list, by its number or email.
3. Answer whether to remove your passkeys too. Say yes only if the devices that hold them are lost.
4. Confirm. Budvo shows a temporary password once.

Then sign in on the dashboard with your email and the temporary password. Budvo asks you to choose a new password right away. Turn two-factor back on in Settings, Security and save the new backup codes.

For the account you pick, recovery:

• sets the temporary password and asks for a new one at the next sign-in,
• turns off two-factor and deletes the backup codes,
• removes passkeys, only if you said so,
• signs the account out on every browser and device,
• writes "recovered from the command line" to the audit log.

If no account is the server owner (admin), it also offers to make yours the owner.

It's safe to run while the server is running, and it works while the server is locked after a restart.

Options

The secret is never accepted as an option, so it can't end up in your shell history. In a script, send it as the first line of standard input (use -i, not -it):

printf '%s\n' "$SECRET" | docker exec -i budvo budvo-server recover --email [email protected] --yes

Change the database password or the recovery key

The same command can rewrap the database key, given the current database password or the recovery key:

docker exec -it budvo budvo-server recover --change-database-passworddocker exec -it budvo budvo-server recover --rotate-recovery-key

A new database password can also be generated for you (leave it empty). You can also make a new recovery key on the dashboard, in Settings, This server, Recovery key. A rotated recovery key is shown once: save it like the first one, because the old key stops working. Neither re-encrypts the database, so both are instant. Older backups keep their own copy of the keyring, so they still open with the password or recovery key that was current when they were taken.