Owner-only. Configure HQ_ADMIN_PWHASH (preferred) or HQ_ADMIN_PASSWORD in systemd env.