First Time Here
Welcome! This page walks you through the 5 things to do on day one, in order. It should take about 15 minutes.
Read this on a laptop/desktop
You'll be switching between a few tabs and your phone (for 2FA). It's easier on a bigger screen.
1. Sign in to Authentik and change your password
Authentik is the single sign-on that gates almost every service here.
- Go to https://auth.deepinthesand.com.
- Sign in with the username and password Ammo sent you.
- Consider changing the password. Click on the gear icon on the top right and then Change password.
Full instructions: Authentik.
2. Set up Two-Factor Authentication (2FA)
Do this now, before you put any real data into any service.
Recommended authenticator apps (FOSS-friendly):
- Android: Aegis Authenticator — encrypted vault with encrypted backups. Install from F-Droid or Google Play.
- iOS: Raivo OTP or Tofu Authenticator. (Aegis is Android-only.)
- Desktop (optional, as a backup): KeePassXC can store TOTP codes alongside your passwords.
Save your recovery / backup codes
When you enable TOTP, you'll be shown one-time recovery codes. Save them somewhere safe — a printed copy in a drawer, or a Secure Note in your Vaultwarden vault. If you lose your phone and don't have these, you will be locked out and Ammo will need to manually reset your 2FA.
Steps in Authentik:
- Click your name (top-right) → User settings → MFA Authenticators.
- Click Enroll → TOTP Device.
- Open your authenticator app, scan the QR code.
- Enter the 6-digit code to confirm.
- Save the recovery codes somewhere safe.
3. Set up Vaultwarden (your password manager)
Vaultwarden has its own login — not Authentik — because it's a zero-knowledge vault: even Ammo cannot read it.
- Go to https://vault.deepinthesand.com.
- Sign in with the temporary master password Ammo sent you.
- Immediately change the master password (Account settings → Security → Master password).
- Pick a long passphrase — and write it on paper somewhere safe. If you forget it, nobody can recover your vault, including Ammo.
- Enable 2FA inside Vaultwarden too (Account settings → Security → Two-step Login).
- Install the Bitwarden browser extension and mobile app, and point them at
https://vault.deepinthesand.combefore logging in.
Full instructions: Vaultwarden.
Now store your Authentik recovery codes in Vaultwarden
Create a Secure Note called "Authentik recovery codes" and paste them in. Belt and braces.
4. Bookmark the dashboard
Open https://deepinthesand.com — that's Dashy, the front door to every service. Bookmark it on every device.
On phones, you can "Add to Home Screen" for an app-like icon.
5. Pick your first few services
Here's a sensible starting set for most people:
| If you want to… | Try |
|---|---|
| Take notes that sync everywhere | Joplin |
| Bookmark / archive web pages | Linkding or Linkwarden |
| Replace Google Search | SearXNG |
| Track tasks / projects | Vikunja |
| Plan meals & shopping | Mealie + Grocy |
| Budget your money | Actual Budget |
| Quick PDF / file tools | Bento PDF, ConvertX |
| Share large files privately | Send |
Want media, photos, files, or paperwork?
Jellyfin, Seerr, Audiobookshelf, Navidrome, Nextcloud, Immich and Paperless-ngx are all available on request — just email or message Ammo.
Getting help
- Browse this site — every service has a dedicated page with apps, setup, and tips.
- Email admin(Q)deepinthesand(P)com — Ammo will usually respond within a day.
- For non-urgent suggestions, drop them in Discourse.
Welcome aboard 🏖️