---
type: concept
tags: [parking, architecture, devices, admin]
sources: [parking-system-architecture]
updated: 2026-06-15
---

# First-Run Setup (device selection)

The admin install flow that makes the system **device-agnostic in practice**: on first run, an
admin assigns devices **per lane** by choosing from the [[device-registry]] catalog and entering
each device's connection config.

> Implementation-derived (from `apps/server` + `apps/web`), not the source doc.

## Flow

1. **Read the catalog** — `GET /api/setup/catalog` returns supported drivers per category (no
   secrets, just schema) plus a `discoverable` list. The web `SetupWizard` renders a picker + the
   driver's config fields, and a **Scan** button for discoverable drivers ([[device-discovery]]).
2. **Assign per lane** — `POST /api/setup/assign` (admin-only, role-guarded; see
   [[local-jwt-auth]]). The server validates the chosen driver + config against the registry
   before persisting to the `lane_devices` table; unknown drivers / missing required fields are
   rejected.
3. **Complete** — `POST /api/setup/complete` marks the single-row `setup_state`.

## Config granularity

Organized **per lane** — each lane gets an access controller, reader(s), and camera(s), each with
its own connection settings. Matches the architecture's "mixable per lane" reality (a lane can
serve permit holders via [[wiegand]] and casual via host-side reads on one relay — see
[[entry-exit-readers]]).

## Security notes

- The assign/state/complete endpoints require the **admin** role ([[local-jwt-auth]]).
- Device **credentials are stored in `lane_devices.config`** — protect at rest
  ([[disk-os-hardening]]); device hosts belong on the isolated VLAN ([[network-isolation]]).