Authentication Commands

Manage Gordon server authentication tokens and passwords.

gordon auth

Subcommands

Subcommand	Description
`token generate`	Generate a new JWT token
`token list`	List all stored tokens
`token revoke`	Revoke a token by ID (use `--all` to revoke all tokens)
`password hash`	Generate bcrypt password hash
`internal`	Show internal registry credentials

gordon auth token generate

Generate a new JWT authentication token for registry access.

gordon auth token generate --subject <name> [options]

Options

Option	Default	Description
`--subject`	(required)	Username/subject for the token
`--scopes`	`push,pull`	Comma-separated scopes
`--expiry`	`30d`	Duration until expiry (0 = never)
`-c, --config`	Auto	Path to config file

Duration Format

Supports human-friendly duration units:

Unit	Description	Example
`d`	Days (24 hours)	`30d`
`w`	Weeks (7 days)	`2w`
`M`	Months (30 days)	`6M`
`y`	Years (365 days)	`1y`

Compound durations are also supported: 1y6M, 2w3d, 1d12h

Standard Go durations also work: 24h, 30m, 1h30m

Examples

# CI token that never expires
gordon auth token generate --subject github-actions --expiry 0

# Read-only token for 30 days
gordon auth token generate --subject reader --scopes pull --expiry 30d

# Push-only token for 1 year
gordon auth token generate --subject builder --scopes push --expiry 1y

# Temporary token (24 hours)
gordon auth token generate --subject temp --expiry 24h

# Token for 6 months
gordon auth token generate --subject deploy --expiry 6M

Output

Token generated successfully!
Subject: github-actions
Scopes: push, pull
Expiry: never

Token (use as password with docker login):
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Usage: docker login -u github-actions -p <token> <registry>

gordon auth token list

List all stored authentication tokens.

gordon auth token list [options]

Output

ID                                    Subject               Expires               Revoked
------------------------------------------------------------------------------------------
a1b2c3d4-e5f6-7890-abcd-ef1234567890  github-actions        never                 no
b2c3d4e5-f6a7-8901-bcde-f12345678901  deploy-bot            2024-02-15 10:30      no
c3d4e5f6-a7b8-9012-cdef-123456789012  old-token             2024-01-01 00:00      yes

gordon auth token revoke

Revoke a token by its ID.

gordon auth token revoke <token-id> [options]
gordon auth token revoke --all  # Revoke all tokens

Example

gordon auth token revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890

Output

Token a1b2c3d4-e5f6-7890-abcd-ef1234567890 has been revoked.

gordon auth password hash

Generate a bcrypt hash for password authentication.

gordon auth password hash

Interactively prompts for a password and outputs the bcrypt hash.

Output

Enter password: ********

Bcrypt hash (store in your secrets backend):
$2a$10$N9qo8uLOickgx2ZMRZoMye...

Then reference the path in your config:
  [auth]
  type = "password"
  password_hash = "gordon/auth/password_hash"

gordon auth internal

Display the auto-generated internal registry credentials.

gordon auth internal

Gordon generates temporary credentials for internal communication with its local registry. These credentials are useful for manual recovery when debugging deployment issues.

Output

Internal Registry Credentials
==============================
Username: gordon-internal
Password: 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...

Usage:
  docker login localhost:5000 -u gordon-internal -p 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...

Notes

Credentials are regenerated each time Gordon starts
Only available while Gordon is running
Used for manual docker pull from the local registry during debugging

Use Cases

Debugging image pull failures
Manual recovery after deployment issues
Inspecting images in the local registry

Token Scopes

Scope	Permission
`push`	Push images to registry
`pull`	Pull images from registry
`push,pull`	Both push and pull (default)

Token Expiry Formats

Format	Duration
`0`	Never expires
`24h`	24 hours
`720h`	30 days
`8760h`	1 year

Workflow Examples

CI/CD Setup

# Generate token for CI
gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0

# Save token as CI secret
# GitHub: Settings → Secrets → New repository secret
# GitLab: Settings → CI/CD → Variables

# Using generated token
docker login -u ci-bot -p <token> registry.mydomain.com

# In CI/CD
echo "$GORDON_TOKEN" | docker login -u ci-bot --password-stdin registry.mydomain.com

Token Rotation

# Generate new token
gordon auth token generate --subject ci-bot --expiry 0

# Update CI secrets with new token

# Revoke old token
gordon auth token revoke <old-token-id>

Password Setup

# Generate hash
gordon auth password hash
# Enter: mypassword

# Store in pass
pass insert gordon/auth/password_hash
# Paste: $2a$10$...

# Configure gordon.toml
[auth]
enabled = true
type = "password"
secrets_backend = "pass"
username = "deploy"
password_hash = "gordon/auth/password_hash"

source

1# Authentication Commands
2
3Manage Gordon server authentication tokens and passwords.
4
5## gordon auth
6
7### Subcommands
8
9| Subcommand | Description |
10|------------|-------------|
11| `token generate` | Generate a new JWT token |
12| `token list` | List all stored tokens |
13| `token revoke` | Revoke a token by ID (use `--all` to revoke all tokens) |
14| `password hash` | Generate bcrypt password hash |
15| `internal` | Show internal registry credentials |
16
17---
18
19## gordon auth token generate
20
21Generate a new JWT authentication token for registry access.
22
23```bash
24gordon auth token generate --subject <name> [options]
25```
26
27### Options
28
29| Option | Default | Description |
30|--------|---------|-------------|
31| `--subject` | (required) | Username/subject for the token |
32| `--scopes` | `push,pull` | Comma-separated scopes |
33| `--expiry` | `30d` | Duration until expiry (0 = never) |
34| `-c, --config` | Auto | Path to config file |
35
36### Duration Format
37
38Supports human-friendly duration units:
39
40| Unit | Description | Example |
41|------|-------------|---------|
42| `d` | Days (24 hours) | `30d` |
43| `w` | Weeks (7 days) | `2w` |
44| `M` | Months (30 days) | `6M` |
45| `y` | Years (365 days) | `1y` |
46
47Compound durations are also supported: `1y6M`, `2w3d`, `1d12h`
48
49Standard Go durations also work: `24h`, `30m`, `1h30m`
50
51### Examples
52
53```bash
54# CI token that never expires
55gordon auth token generate --subject github-actions --expiry 0
56
57# Read-only token for 30 days
58gordon auth token generate --subject reader --scopes pull --expiry 30d
59
60# Push-only token for 1 year
61gordon auth token generate --subject builder --scopes push --expiry 1y
62
63# Temporary token (24 hours)
64gordon auth token generate --subject temp --expiry 24h
65
66# Token for 6 months
67gordon auth token generate --subject deploy --expiry 6M
68```
69
70### Output
71
72```
73Token generated successfully!
74Subject: github-actions
75Scopes: push, pull
76Expiry: never
77
78Token (use as password with docker login):
79eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
80
81Usage: docker login -u github-actions -p <token> <registry>
82```
83
84---
85
86## gordon auth token list
87
88List all stored authentication tokens.
89
90```bash
91gordon auth token list [options]
92```
93
94### Output
95
96```
97ID                                    Subject               Expires               Revoked
98------------------------------------------------------------------------------------------
99a1b2c3d4-e5f6-7890-abcd-ef1234567890  github-actions        never                 no
100b2c3d4e5-f6a7-8901-bcde-f12345678901  deploy-bot            2024-02-15 10:30      no
101c3d4e5f6-a7b8-9012-cdef-123456789012  old-token             2024-01-01 00:00      yes
102```
103
104---
105
106## gordon auth token revoke
107
108Revoke a token by its ID.
109
110```bash
111gordon auth token revoke <token-id> [options]
112gordon auth token revoke --all  # Revoke all tokens
113```
114
115### Example
116
117```bash
118gordon auth token revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
119```
120
121### Output
122
123```
124Token a1b2c3d4-e5f6-7890-abcd-ef1234567890 has been revoked.
125```
126
127---
128
129## gordon auth password hash
130
131Generate a bcrypt hash for password authentication.
132
133```bash
134gordon auth password hash
135```
136
137Interactively prompts for a password and outputs the bcrypt hash.
138
139### Output
140
141```
142Enter password: ********
143
144Bcrypt hash (store in your secrets backend):
145$2a$10$N9qo8uLOickgx2ZMRZoMye...
146
147Then reference the path in your config:
148  [auth]
149  type = "password"
150  password_hash = "gordon/auth/password_hash"
151```
152
153---
154
155## gordon auth internal
156
157Display the auto-generated internal registry credentials.
158
159```bash
160gordon auth internal
161```
162
163Gordon generates temporary credentials for internal communication with its local registry. These credentials are useful for manual recovery when debugging deployment issues.
164
165### Output
166
167```
168Internal Registry Credentials
169==============================
170Username: gordon-internal
171Password: 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
172
173Usage:
174  docker login localhost:5000 -u gordon-internal -p 8f3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c...
175```
176
177### Notes
178
179- Credentials are regenerated each time Gordon starts
180- Only available while Gordon is running
181- Used for manual `docker pull` from the local registry during debugging
182
183### Use Cases
184
185- Debugging image pull failures
186- Manual recovery after deployment issues
187- Inspecting images in the local registry
188
189---
190
191## Token Scopes
192
193| Scope | Permission |
194|-------|------------|
195| `push` | Push images to registry |
196| `pull` | Pull images from registry |
197| `push,pull` | Both push and pull (default) |
198
199## Token Expiry Formats
200
201| Format | Duration |
202|--------|----------|
203| `0` | Never expires |
204| `24h` | 24 hours |
205| `720h` | 30 days |
206| `8760h` | 1 year |
207
208---
209
210## Workflow Examples
211
212### CI/CD Setup
213
214```bash
215# Generate token for CI
216gordon auth token generate --subject ci-bot --scopes push,pull --expiry 0
217
218# Save token as CI secret
219# GitHub: Settings → Secrets → New repository secret
220# GitLab: Settings → CI/CD → Variables
221```
222
223### Docker Login
224
225```bash
226# Using generated token
227docker login -u ci-bot -p <token> registry.mydomain.com
228
229# In CI/CD
230echo "$GORDON_TOKEN" | docker login -u ci-bot --password-stdin registry.mydomain.com
231```
232
233### Token Rotation
234
235```bash
236# Generate new token
237gordon auth token generate --subject ci-bot --expiry 0
238
239# Update CI secrets with new token
240
241# Revoke old token
242gordon auth token revoke <old-token-id>
243```
244
245### Password Setup
246
247```bash
248# Generate hash
249gordon auth password hash
250# Enter: mypassword
251
252# Store in pass
253pass insert gordon/auth/password_hash
254# Paste: $2a$10$...
255
256# Configure gordon.toml
257[auth]
258enabled = true
259type = "password"
260secrets_backend = "pass"
261username = "deploy"
262password_hash = "gordon/auth/password_hash"
263```
264
265## Related
266
267- [CLI Overview](./index.md)
268- [Authentication Configuration](../config/auth.md)

auth.md RawHistoryFolder

Authentication Commands

gordon auth

Subcommands

gordon auth token generate

Options

Duration Format

Examples

Output

gordon auth token list

Output

gordon auth token revoke

Example

Output

gordon auth password hash

Output

gordon auth internal

Output

Notes

Use Cases

Token Scopes

Token Expiry Formats

Workflow Examples

CI/CD Setup

Docker Login

Token Rotation

Password Setup

Related

auth.md Raw History Folder