Authentication Commands
Manage Gordon server authentication tokens.
gordon auth
Subcommands
| Subcommand |
Description |
login |
Authenticate with a remote Gordon server |
token generate |
Generate a new JWT token |
token list |
List all stored tokens |
token revoke |
Revoke a token by ID (use --all to revoke all tokens) |
internal |
Show internal registry credentials |
gordon auth login
Authenticate with a remote Gordon server using a pre-generated token.
gordon auth login [options]
Options
| Option |
Description |
-r, --remote |
Remote to authenticate with (defaults to active remote) |
-t, --token |
Authentication token to store for the remote |
Description
This command stores a pre-generated token for use with a remote Gordon server. When pass is available, the token is stored encrypted at gordon/remotes/<name>/token and any plaintext token fields are cleared from remotes.toml. When pass is unavailable, the token is stored in plaintext in remotes.toml with a warning.
The token is verified against /admin/status on a best-effort basis.
Examples
# Store a token for the active remote
gordon auth login --token <token>
# Store a token for a specific remote
gordon auth login --remote prod --token <token>
Output
When pass is available:
Token stored in pass for remote 'prod'
When pass is not available:
Warning: 'pass' not available. Storing token in plaintext config. Consider installing pass (https://www.passwordstore.org/) for secure token storage.
Token stored for remote 'prod'
gordon auth token generate
Generate a new JWT authentication token for registry access.
gordon auth token generate --subject <name> [options]
Options
| Option |
Default |
Description |
--subject |
(required) |
Username/subject for the token |
--scopes |
push,pull |
Comma-separated scopes |
--expiry |
30d |
Duration until expiry (0 = never) |
-c, --config |
Auto |
Path to config file |
Supports human-friendly duration units:
| Unit |
Description |
Example |
d |
Days (24 hours) |
30d |
w |
Weeks (7 days) |
2w |
M |
Months (30 days) |
6M |
y |
Years (365 days) |
1y |
Compound durations are also supported: 1y6M, 2w3d, 1d12h
Standard Go durations also work: 24h, 30m, 1h30m
Scopes
Registry scopes: push, pull, push,pull
Admin scopes: admin:*:*, admin:routes:read, admin:routes:write, admin:config:read, admin:config:write, admin:status:read, admin:secrets:read, admin:secrets:write
Combine scopes with commas:
gordon auth token generate --subject admin --scopes "push,pull,admin:*:*" --expiry 0
Examples
# CI token that never expires
gordon auth token generate --subject github-actions --expiry 0
# Read-only token for 30 days
gordon auth token generate --subject reader --scopes pull --expiry 30d
# Push-only token for 1 year
gordon auth token generate --subject builder --scopes push --expiry 1y
# Temporary token (24 hours)
gordon auth token generate --subject temp --expiry 24h
# Full admin access token
gordon auth token generate --subject admin --scopes "push,pull,admin:*:*" --expiry 6M
# Read-only admin token
gordon auth token generate --subject monitor --scopes "admin:status:read" --expiry 30d
Output
Token generated successfully!
Subject: github-actions
Scopes: push, pull
Expiry: never
Token (use as password with docker login):
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Usage: docker login -u github-actions -p <token> <registry>
gordon auth token list
List all stored authentication tokens.
gordon auth token list [options]
Output
ID Subject Expires Revoked
------------------------------------------------------------------------------------------
a1b2c3d4-e5f6-7890-abcd-ef1234567890 github-actions never no
b2c3d4e5-f6a7-8901-bcde-f12345678901 deploy-bot 2024-02-15 10:30 no
c3d4e5f6-a7b8-9012-cdef-123456789012 old-token 2024-01-01 00:00 yes
gordon auth token revoke
Revoke a token by its ID.
gordon auth token revoke <token-id> [options]
gordon auth token revoke --all # Revoke all tokens
Example
gordon auth token revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
Output
Token a1b2c3d4-e5f6-7890-abcd-ef1234567890 has been revoked.
gordon auth internal
Display the auto-generated internal registry credentials.
gordon auth internal
Gordon generates temporary credentials for loopback-only communication with its local registry. These credentials are useful for manual recovery when debugging deployment issues.
When registry auth is enabled, Gordon also generates a separate service token for its own registry-domain pulls. That token is not exposed via the CLI.
Output
Internal Registry Credentials
==============================
Username: gordon-internal
Password: 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
Usage:
docker login localhost:5000 -u gordon-internal -p 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
Notes
- Credentials are regenerated each time Gordon starts
- Only available while Gordon is running
- Used for manual
docker pull from the local registry during debugging
- Separate from the service token used by Gordon core for registry-domain pulls
Use Cases
- Debugging image pull failures
- Manual recovery after deployment issues
- Inspecting images in the local registry
Token Scopes
| Scope |
Permission |
push |
Push images to registry |
pull |
Pull images from registry |
push,pull |
Both push and pull (default) |
admin:*:* |
Full admin access |
admin:routes:read |
Read-only routes access |
admin:routes:write |
Routes write access |
admin:config:read |
Read-only config access |
admin:config:write |
Config write access |
admin:status:read |
Read-only status/health |
admin:secrets:read |
List secret keys |
admin:secrets:write |
Set/delete secrets |
| Format |
Duration |
0 |
Never expires |
24h |
24 hours |
720h |
30 days |
8760h |
1 year |
Workflow Examples
CI/CD Setup
# Generate token for CI
gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0
# Save token as CI secret
# GitHub: Settings > Secrets > New repository secret
# GitLab: Settings > CI/CD > Variables
Docker Login
# Using generated token
docker login -u ci-bot -p <token> registry.mydomain.com
# In CI/CD
echo "$GORDON_TOKEN" | docker login -u ci-bot --password-stdin registry.mydomain.com
Token Rotation
# Generate new token
gordon auth token generate --subject ci-bot --expiry 0
# Update CI secrets with new token
# Revoke old token
gordon auth token revoke <old-token-id>
Token-only Setup
# Create token secret
pass insert gordon/auth/token_secret
# Enter a random 32+ character string
# Configure gordon.toml
[auth]
enabled = true
secrets_backend = "pass"
token_secret = "gordon/auth/token_secret"
# Generate a deploy token
gordon auth token generate --subject deploy --scopes "push,pull" --expiry 0
source
1# Authentication Commands
2
3Manage Gordon server authentication tokens.
4
5## gordon auth
6
7### Subcommands
8
9| Subcommand | Description |
10|------------|-------------|
11| `login` | Authenticate with a remote Gordon server |
12| `token generate` | Generate a new JWT token |
13| `token list` | List all stored tokens |
14| `token revoke` | Revoke a token by ID (use `--all` to revoke all tokens) |
15| `internal` | Show internal registry credentials |
16
17---
18
19## gordon auth login
20
21Authenticate with a remote Gordon server using a pre-generated token.
22
23```bash
24gordon auth login [options]
25```
26
27### Options
28
29| Option | Description |
30|--------|-------------|
31| `-r, --remote` | Remote to authenticate with (defaults to active remote) |
32| `-t, --token` | Authentication token to store for the remote |
33
34### Description
35
36This command stores a pre-generated token for use with a remote Gordon server. When [pass](https://www.passwordstore.org/) is available, the token is stored encrypted at `gordon/remotes/<name>/token` and any plaintext token fields are cleared from `remotes.toml`. When `pass` is unavailable, the token is stored in plaintext in `remotes.toml` with a warning.
37
38The token is verified against `/admin/status` on a best-effort basis.
39
40### Examples
41
42```bash
43# Store a token for the active remote
44gordon auth login --token <token>
45
46# Store a token for a specific remote
47gordon auth login --remote prod --token <token>
48```
49
50### Output
51
52When `pass` is available:
53
54```text
55Token stored in pass for remote 'prod'
56```
57
58When `pass` is not available:
59
60```text
61Warning: 'pass' not available. Storing token in plaintext config. Consider installing pass (https://www.passwordstore.org/) for secure token storage.
62Token stored for remote 'prod'
63```
64
65---
66
67## gordon auth token generate
68
69Generate a new JWT authentication token for registry access.
70
71```bash
72gordon auth token generate --subject <name> [options]
73```
74
75### Options
76
77| Option | Default | Description |
78|--------|---------|-------------|
79| `--subject` | (required) | Username/subject for the token |
80| `--scopes` | `push,pull` | Comma-separated scopes |
81| `--expiry` | `30d` | Duration until expiry (0 = never) |
82| `-c, --config` | Auto | Path to config file |
83
84### Duration Format
85
86Supports human-friendly duration units:
87
88| Unit | Description | Example |
89|------|-------------|---------|
90| `d` | Days (24 hours) | `30d` |
91| `w` | Weeks (7 days) | `2w` |
92| `M` | Months (30 days) | `6M` |
93| `y` | Years (365 days) | `1y` |
94
95Compound durations are also supported: `1y6M`, `2w3d`, `1d12h`
96
97Standard Go durations also work: `24h`, `30m`, `1h30m`
98
99### Scopes
100
101Registry scopes: `push`, `pull`, `push,pull`
102
103Admin scopes: `admin:*:*`, `admin:routes:read`, `admin:routes:write`, `admin:config:read`, `admin:config:write`, `admin:status:read`, `admin:secrets:read`, `admin:secrets:write`
104
105Combine scopes with commas:
106
107```bash
108gordon auth token generate --subject admin --scopes "push,pull,admin:*:*" --expiry 0
109```
110
111### Examples
112
113```bash
114# CI token that never expires
115gordon auth token generate --subject github-actions --expiry 0
116
117# Read-only token for 30 days
118gordon auth token generate --subject reader --scopes pull --expiry 30d
119
120# Push-only token for 1 year
121gordon auth token generate --subject builder --scopes push --expiry 1y
122
123# Temporary token (24 hours)
124gordon auth token generate --subject temp --expiry 24h
125
126# Full admin access token
127gordon auth token generate --subject admin --scopes "push,pull,admin:*:*" --expiry 6M
128
129# Read-only admin token
130gordon auth token generate --subject monitor --scopes "admin:status:read" --expiry 30d
131```
132
133### Output
134
135```
136Token generated successfully!
137Subject: github-actions
138Scopes: push, pull
139Expiry: never
140
141Token (use as password with docker login):
142eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
143
144Usage: docker login -u github-actions -p <token> <registry>
145```
146
147---
148
149## gordon auth token list
150
151List all stored authentication tokens.
152
153```bash
154gordon auth token list [options]
155```
156
157### Output
158
159```
160ID Subject Expires Revoked
161------------------------------------------------------------------------------------------
162a1b2c3d4-e5f6-7890-abcd-ef1234567890 github-actions never no
163b2c3d4e5-f6a7-8901-bcde-f12345678901 deploy-bot 2024-02-15 10:30 no
164c3d4e5f6-a7b8-9012-cdef-123456789012 old-token 2024-01-01 00:00 yes
165```
166
167---
168
169## gordon auth token revoke
170
171Revoke a token by its ID.
172
173```bash
174gordon auth token revoke <token-id> [options]
175gordon auth token revoke --all # Revoke all tokens
176```
177
178### Example
179
180```bash
181gordon auth token revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
182```
183
184### Output
185
186```
187Token a1b2c3d4-e5f6-7890-abcd-ef1234567890 has been revoked.
188```
189
190---
191
192## gordon auth internal
193
194Display the auto-generated internal registry credentials.
195
196```bash
197gordon auth internal
198```
199
200Gordon generates temporary credentials for loopback-only communication with its local registry. These credentials are useful for manual recovery when debugging deployment issues.
201
202When registry auth is enabled, Gordon also generates a separate service token for its own registry-domain pulls. That token is not exposed via the CLI.
203
204### Output
205
206```
207Internal Registry Credentials
208==============================
209Username: gordon-internal
210Password: 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
211
212Usage:
213 docker login localhost:5000 -u gordon-internal -p 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
214```
215
216### Notes
217
218- Credentials are regenerated each time Gordon starts
219- Only available while Gordon is running
220- Used for manual `docker pull` from the local registry during debugging
221- Separate from the service token used by Gordon core for registry-domain pulls
222
223### Use Cases
224
225- Debugging image pull failures
226- Manual recovery after deployment issues
227- Inspecting images in the local registry
228
229---
230
231## Token Scopes
232
233| Scope | Permission |
234|-------|------------|
235| `push` | Push images to registry |
236| `pull` | Pull images from registry |
237| `push,pull` | Both push and pull (default) |
238| `admin:*:*` | Full admin access |
239| `admin:routes:read` | Read-only routes access |
240| `admin:routes:write` | Routes write access |
241| `admin:config:read` | Read-only config access |
242| `admin:config:write` | Config write access |
243| `admin:status:read` | Read-only status/health |
244| `admin:secrets:read` | List secret keys |
245| `admin:secrets:write` | Set/delete secrets |
246
247## Token Expiry Formats
248
249| Format | Duration |
250|--------|----------|
251| `0` | Never expires |
252| `24h` | 24 hours |
253| `720h` | 30 days |
254| `8760h` | 1 year |
255
256---
257
258## Workflow Examples
259
260### CI/CD Setup
261
262```bash
263# Generate token for CI
264gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0
265
266# Save token as CI secret
267# GitHub: Settings > Secrets > New repository secret
268# GitLab: Settings > CI/CD > Variables
269```
270
271### Docker Login
272
273```bash
274# Using generated token
275docker login -u ci-bot -p <token> registry.mydomain.com
276
277# In CI/CD
278echo "$GORDON_TOKEN" | docker login -u ci-bot --password-stdin registry.mydomain.com
279```
280
281### Token Rotation
282
283```bash
284# Generate new token
285gordon auth token generate --subject ci-bot --expiry 0
286
287# Update CI secrets with new token
288
289# Revoke old token
290gordon auth token revoke <old-token-id>
291```
292
293### Token-only Setup
294
295```bash
296# Create token secret
297pass insert gordon/auth/token_secret
298# Enter a random 32+ character string
299
300# Configure gordon.toml
301[auth]
302enabled = true
303secrets_backend = "pass"
304token_secret = "gordon/auth/token_secret"
305
306# Generate a deploy token
307gordon auth token generate --subject deploy --scopes "push,pull" --expiry 0
308```
309
310## Related
311
312- [CLI Overview](./index.md)
313- [Authentication Configuration](../config/auth.md)