detached 270f2c9

docs: update auth config to use inferred type and new CLI commands

commit
270f2c9eb1e3e2f648ee3e1c4b26fed98ab45757
author
bnema · · 2026-01-18 03:17 UTC
parent
bf8e9b6
signature
unsigned
13 files · +204 -52
Unified
UnifiedSplit
M .github/actions/deploy/README.md +1 -2
@@ -122,12 +122,11 @@ In your repository settings, add:
122122
123123 ### 3. Configure Gordon
124124
125-Ensure your Gordon config uses token authentication:
125+Ensure your Gordon config has authentication enabled:
126126
127127 ```toml
128128 [auth]
129129 enabled = true
130-type = "token"
131130 secrets_backend = "pass" # or "sops"
132131 token_secret = "gordon/auth/token_secret"
133132 ```
@@ -122,12 +122,11 @@ In your repository settings, add:
122 122
123 ### 3. Configure Gordon123 ### 3. Configure Gordon
124 124
125-Ensure your Gordon config uses token authentication:125+Ensure your Gordon config has authentication enabled:
126 126
127 ```toml127 ```toml
128 [auth]128 [auth]
129 enabled = true129 enabled = true
130-type = "token"
131 secrets_backend = "pass" # or "sops"130 secrets_backend = "pass" # or "sops"
132 token_secret = "gordon/auth/token_secret"131 token_secret = "gordon/auth/token_secret"
133 ```132 ```
M docs/cli/auth.md +58 -2
@@ -8,6 +8,7 @@ Manage Gordon server authentication tokens and passwords.
88
99 | Subcommand | Description |
1010 |------------|-------------|
11+| `login` | Authenticate with a remote Gordon server |
1112 | `token generate` | Generate a new JWT token |
1213 | `token list` | List all stored tokens |
1314 | `token revoke` | Revoke a token by ID (use `--all` to revoke all tokens) |
@@ -16,6 +17,56 @@ Manage Gordon server authentication tokens and passwords.
1617
1718 ---
1819
20+## gordon auth login
21+
22+Authenticate with a remote Gordon server using password authentication.
23+
24+```bash
25+gordon auth login [options]
26+```
27+
28+### Options
29+
30+| Option | Description |
31+|--------|-------------|
32+| `-r, --remote` | Remote to authenticate with (defaults to active remote) |
33+| `-u, --username` | Username for authentication |
34+
35+### Description
36+
37+This command prompts for your username and password, authenticates with the remote server's `/auth/password` endpoint, and stores the returned token in your remotes configuration.
38+
39+The token is a long-lived JWT (7 days) that's used for subsequent CLI operations against the remote.
40+
41+> **Note:** This command only works with servers that have password authentication configured (`username` + `password_hash`). For token-only servers, use `gordon remotes set-token` instead.
42+
43+### Examples
44+
45+```bash
46+# Login using active remote
47+gordon auth login
48+
49+# Login to specific remote
50+gordon auth login --remote prod
51+
52+# Pre-fill username
53+gordon auth login --username admin
54+```
55+
56+### Output
57+
58+```
59+Username: admin
60+Password: ********
61+Authenticating with prod...
62+
63+✓ Authentication successful!
64+Token stored for remote 'prod'
65+Expires in: 604800 seconds
66+```
67+
68+---
69+
1970 ## gordon auth token generate
2071
2172 Generate a new JWT authentication token for registry access.
@@ -146,8 +197,9 @@ $2a$10$N9qo8uLOickgx2ZMRZoMye...
146197
147198 Then reference the path in your config:
148199 [auth]
149- type = "password"
200+ username = "deploy"
150201 password_hash = "gordon/auth/password_hash"
202+ token_secret = "gordon/auth/token_secret"
151203 ```
152204
153205 ---
@@ -253,13 +305,17 @@ gordon auth password hash
253305 pass insert gordon/auth/password_hash
254306 # Paste: $2a$10$...
255307
308+# Create token secret
309+pass insert gordon/auth/token_secret
310+# Enter a random 32+ character string
311+
256312 # Configure gordon.toml
257313 [auth]
258314 enabled = true
259-type = "password"
260315 secrets_backend = "pass"
261316 username = "deploy"
262317 password_hash = "gordon/auth/password_hash"
318+token_secret = "gordon/auth/token_secret"
263319 ```
264320
265321 ## Related
@@ -8,6 +8,7 @@ Manage Gordon server authentication tokens and passwords.
8 8
9 | Subcommand | Description |9 | Subcommand | Description |
10 |------------|-------------|10 |------------|-------------|
11+| `login` | Authenticate with a remote Gordon server |
11 | `token generate` | Generate a new JWT token |12 | `token generate` | Generate a new JWT token |
12 | `token list` | List all stored tokens |13 | `token list` | List all stored tokens |
13 | `token revoke` | Revoke a token by ID (use `--all` to revoke all tokens) |14 | `token revoke` | Revoke a token by ID (use `--all` to revoke all tokens) |
@@ -16,6 +17,56 @@ Manage Gordon server authentication tokens and passwords.
16 17
17 ---18 ---
18 19
20+## gordon auth login
21+
22+Authenticate with a remote Gordon server using password authentication.
23+
24+```bash
25+gordon auth login [options]
26+```
27+
28+### Options
29+
30+| Option | Description |
31+|--------|-------------|
32+| `-r, --remote` | Remote to authenticate with (defaults to active remote) |
33+| `-u, --username` | Username for authentication |
34+
35+### Description
36+
37+This command prompts for your username and password, authenticates with the remote server's `/auth/password` endpoint, and stores the returned token in your remotes configuration.
38+
39+The token is a long-lived JWT (7 days) that's used for subsequent CLI operations against the remote.
40+
41+> **Note:** This command only works with servers that have password authentication configured (`username` + `password_hash`). For token-only servers, use `gordon remotes set-token` instead.
42+
43+### Examples
44+
45+```bash
46+# Login using active remote
47+gordon auth login
48+
49+# Login to specific remote
50+gordon auth login --remote prod
51+
52+# Pre-fill username
53+gordon auth login --username admin
54+```
55+
56+### Output
57+
58+```
59+Username: admin
60+Password: ********
61+Authenticating with prod...
62+
63+✓ Authentication successful!
64+Token stored for remote 'prod'
65+Expires in: 604800 seconds
66+```
67+
68+---
69+
19 ## gordon auth token generate70 ## gordon auth token generate
20 71
21 Generate a new JWT authentication token for registry access.72 Generate a new JWT authentication token for registry access.
@@ -146,8 +197,9 @@ $2a$10$N9qo8uLOickgx2ZMRZoMye...
146 197
147 Then reference the path in your config:198 Then reference the path in your config:
148 [auth]199 [auth]
149- type = "password"200+ username = "deploy"
150 password_hash = "gordon/auth/password_hash"201 password_hash = "gordon/auth/password_hash"
202+ token_secret = "gordon/auth/token_secret"
151 ```203 ```
152 204
153 ---205 ---
@@ -253,13 +305,17 @@ gordon auth password hash
253 pass insert gordon/auth/password_hash305 pass insert gordon/auth/password_hash
254 # Paste: $2a$10$...306 # Paste: $2a$10$...
255 307
308+# Create token secret
309+pass insert gordon/auth/token_secret
310+# Enter a random 32+ character string
311+
256 # Configure gordon.toml312 # Configure gordon.toml
257 [auth]313 [auth]
258 enabled = true314 enabled = true
259-type = "password"
260 secrets_backend = "pass"315 secrets_backend = "pass"
261 username = "deploy"316 username = "deploy"
262 password_hash = "gordon/auth/password_hash"317 password_hash = "gordon/auth/password_hash"
318+token_secret = "gordon/auth/token_secret"
263 ```319 ```
264 320
265 ## Related321 ## Related
M docs/cli/remotes.md +47 -0
@@ -12,6 +12,7 @@ Manage saved remote Gordon instances for easier CLI usage.
1212 | `add` | Add a new remote |
1313 | `remove` | Remove a saved remote |
1414 | `use` | Set active remote |
15+| `set-token` | Set or update token for a remote |
1516
1617 ---
1718
@@ -165,6 +166,52 @@ gordon remotes use prod
165166
166167 ---
167168
169+## gordon remotes set-token
170+
171+Set or update the authentication token for a saved remote.
172+
173+```bash
174+gordon remotes set-token <name> <token>
175+```
176+
177+### Arguments
178+
179+| Argument | Description |
180+|----------|-------------|
181+| `<name>` | Name of the remote |
182+| `<token>` | The JWT token to set |
183+
184+### Description
185+
186+This command is useful when:
187+
188+- The server uses token-based authentication (not password auth)
189+- You have a pre-generated token from `gordon auth token generate`
190+- You want to update an expired token
191+
192+For servers with password authentication, use `gordon auth login` instead.
193+
194+### Examples
195+
196+```bash
197+# Set token for prod remote
198+gordon remotes set-token prod eyJhbGciOiJIUzI1NiIs...
199+
200+# Set token from file
201+gordon remotes set-token staging $(cat token.txt)
202+
203+# Set token from environment variable
204+gordon remotes set-token prod "$GORDON_TOKEN"
205+```
206+
207+### Output
208+
209+```
210+✓ Token updated for remote 'prod'
211+```
212+
213+---
214+
168215 ## Configuration File
169216
170217 Remotes are stored in `~/.config/gordon/remotes.toml`:
@@ -12,6 +12,7 @@ Manage saved remote Gordon instances for easier CLI usage.
12 | `add` | Add a new remote |12 | `add` | Add a new remote |
13 | `remove` | Remove a saved remote |13 | `remove` | Remove a saved remote |
14 | `use` | Set active remote |14 | `use` | Set active remote |
15+| `set-token` | Set or update token for a remote |
15 16
16 ---17 ---
17 18
@@ -165,6 +166,52 @@ gordon remotes use prod
165 166
166 ---167 ---
167 168
169+## gordon remotes set-token
170+
171+Set or update the authentication token for a saved remote.
172+
173+```bash
174+gordon remotes set-token <name> <token>
175+```
176+
177+### Arguments
178+
179+| Argument | Description |
180+|----------|-------------|
181+| `<name>` | Name of the remote |
182+| `<token>` | The JWT token to set |
183+
184+### Description
185+
186+This command is useful when:
187+
188+- The server uses token-based authentication (not password auth)
189+- You have a pre-generated token from `gordon auth token generate`
190+- You want to update an expired token
191+
192+For servers with password authentication, use `gordon auth login` instead.
193+
194+### Examples
195+
196+```bash
197+# Set token for prod remote
198+gordon remotes set-token prod eyJhbGciOiJIUzI1NiIs...
199+
200+# Set token from file
201+gordon remotes set-token staging $(cat token.txt)
202+
203+# Set token from environment variable
204+gordon remotes set-token prod "$GORDON_TOKEN"
205+```
206+
207+### Output
208+
209+```
210+✓ Token updated for remote 'prod'
211+```
212+
213+---
214+
168 ## Configuration File215 ## Configuration File
169 216
170 Remotes are stored in `~/.config/gordon/remotes.toml`:217 Remotes are stored in `~/.config/gordon/remotes.toml`:
M docs/config/auth.md +51 -16
@@ -34,10 +34,13 @@ enabled = false
3434 ```toml
3535 [auth]
3636 enabled = true
37-type = "token"
3837 secrets_backend = "pass"
3938 token_secret = "gordon/auth/token_secret"
4039 token_expiry = "30d"
40+
41+# Optional: enable password authentication
42+username = "deploy"
43+password_hash = "gordon/auth/password_hash"
4144 ```
4245
4346 ## Options
@@ -45,12 +48,22 @@ token_expiry = "30d"
4548 | Option | Type | Default | Description |
4649 |--------|------|---------|-------------|
4750 | `enabled` | bool | `true` | Enable authentication |
48-| `type` | string | `"password"` | Auth type: `"password"` or `"token"` |
4951 | `secrets_backend` | string | `"unsafe"` | Secrets backend: `"pass"`, `"sops"`, or `"unsafe"` |
50-| `username` | string | - | Username for password auth |
51-| `password_hash` | string | - | Path to bcrypt hash in secrets backend |
52-| `token_secret` | string | - | Path to JWT signing secret in secrets backend |
52+| `token_secret` | string | - | **Required.** Path to JWT signing secret in secrets backend |
5353 | `token_expiry` | string | `"30d"` | Token validity duration (0 = never expires) |
54+| `username` | string | - | Username for password auth (optional) |
55+| `password_hash` | string | - | Path to bcrypt hash in secrets backend (optional) |
56+
57+## Authentication Modes
58+
59+Gordon infers the authentication mode from your configuration:
60+
61+| Config | Mode | Description |
62+|--------|------|-------------|
63+| Only `token_secret` | Token-only | JWT tokens for all access |
64+| `token_secret` + `username` + `password_hash` | Password + Token | Password for interactive login, tokens for CI/CD |
65+
66+Tokens always work regardless of mode. The difference is whether password authentication is available.
5467
5568 ## Environment Variables
5669
@@ -81,14 +94,13 @@ See [Secret Providers](./secrets.md) for detailed configuration of each backend.
8194
8295 ## Authentication Types
8396
84-### Token Authentication (Recommended)
97+### Token-Only Mode
8598
86-JWT-based authentication, ideal for CI/CD pipelines:
99+JWT-based authentication, ideal for CI/CD pipelines when you don't need interactive login:
87100
88101 ```toml
89102 [auth]
90103 enabled = true
91-type = "token"
92104 secrets_backend = "pass"
93105 token_secret = "gordon/auth/token_secret"
94106 token_expiry = "30d"
@@ -121,19 +133,21 @@ gordon auth token revoke <token-id>
121133 gordon auth token revoke --all
122134 ```
123135
124-### Password Authentication
136+### Password + Token Mode
125137
126-Simple username/password authentication:
138+Password authentication for interactive login, plus tokens for CI/CD:
127139
128140 ```toml
129141 [auth]
130142 enabled = true
131-type = "password"
132143 secrets_backend = "pass"
133144 username = "deploy"
134145 password_hash = "gordon/auth/password_hash"
146+token_secret = "gordon/auth/token_secret"
135147 ```
136148
149+When `username` and `password_hash` are configured, both password and token authentication work.
150+
137151 **Setup:**
138152 ```bash
139153 # Generate bcrypt hash
@@ -143,13 +157,36 @@ gordon auth password hash
143157 # Store hash in secrets backend
144158 pass insert gordon/auth/password_hash
145159 # Paste the bcrypt hash
160+
161+# Create token secret (for CI/CD token generation)
162+pass insert gordon/auth/token_secret
163+# Enter a random 32+ character string
146164 ```
147165
148166 **Usage:**
149167 ```bash
168+# Docker registry access
150169 docker login -u deploy -p <password> registry.mydomain.com
170+
171+# Remote CLI authentication
172+gordon auth login --remote prod
173+# Enter username and password when prompted
151174 ```
152175
176+**Remote CLI Authentication:**
177+
178+With password authentication enabled, you can use `gordon auth login` to obtain a token for remote CLI operations:
179+
180+```bash
181+gordon auth login --remote prod
182+# Username: deploy
183+# Password: ********
184+# ✓ Authentication successful!
185+# Token stored for remote 'prod'
186+```
187+
188+The returned token is stored automatically and used for subsequent CLI commands.
189+
153190 ## Token Scopes
154191
155192 Tokens can have different permission levels:
@@ -232,12 +269,11 @@ enabled = false
232269
233270 ## Examples
234271
235-### CI/CD Setup
272+### CI/CD Setup (Token-Only)
236273
237274 ```toml
238275 [auth]
239276 enabled = true
240-type = "token"
241277 secrets_backend = "pass"
242278 token_secret = "gordon/auth/token_secret"
243279 ```
@@ -253,15 +289,15 @@ In GitHub Actions:
253289 run: docker login -u github-actions -p ${{ secrets.GORDON_TOKEN }} ${{ secrets.GORDON_REGISTRY }}
254290 ```
255291
256-### Production with Password
292+### Production with Password + Token
257293
258294 ```toml
259295 [auth]
260296 enabled = true
261-type = "password"
262297 secrets_backend = "pass"
263298 username = "deploy"
264299 password_hash = "gordon/auth/password_hash"
300+token_secret = "gordon/auth/token_secret"
265301 ```
266302
267303 ### Enterprise with SOPS
@@ -269,7 +305,6 @@ password_hash = "gordon/auth/password_hash"
269305 ```toml
270306 [auth]
271307 enabled = true
272-type = "token"
273308 secrets_backend = "sops"
274309 token_secret = "gordon/auth/token_secret"
275310 ```
@@ -34,10 +34,13 @@ enabled = false
34 ```toml34 ```toml
35 [auth]35 [auth]
36 enabled = true36 enabled = true
37-type = "token"
38 secrets_backend = "pass"37 secrets_backend = "pass"
39 token_secret = "gordon/auth/token_secret"38 token_secret = "gordon/auth/token_secret"
40 token_expiry = "30d"39 token_expiry = "30d"
40+
41+# Optional: enable password authentication
42+username = "deploy"
43+password_hash = "gordon/auth/password_hash"
41 ```44 ```
42 45
43 ## Options46 ## Options
@@ -45,12 +48,22 @@ token_expiry = "30d"
45 | Option | Type | Default | Description |48 | Option | Type | Default | Description |
46 |--------|------|---------|-------------|49 |--------|------|---------|-------------|
47 | `enabled` | bool | `true` | Enable authentication |50 | `enabled` | bool | `true` | Enable authentication |
48-| `type` | string | `"password"` | Auth type: `"password"` or `"token"` |
49 | `secrets_backend` | string | `"unsafe"` | Secrets backend: `"pass"`, `"sops"`, or `"unsafe"` |51 | `secrets_backend` | string | `"unsafe"` | Secrets backend: `"pass"`, `"sops"`, or `"unsafe"` |
50-| `username` | string | - | Username for password auth |52+| `token_secret` | string | - | **Required.** Path to JWT signing secret in secrets backend |
51-| `password_hash` | string | - | Path to bcrypt hash in secrets backend |
52-| `token_secret` | string | - | Path to JWT signing secret in secrets backend |
53 | `token_expiry` | string | `"30d"` | Token validity duration (0 = never expires) |53 | `token_expiry` | string | `"30d"` | Token validity duration (0 = never expires) |
54+| `username` | string | - | Username for password auth (optional) |
55+| `password_hash` | string | - | Path to bcrypt hash in secrets backend (optional) |
56+
57+## Authentication Modes
58+
59+Gordon infers the authentication mode from your configuration:
60+
61+| Config | Mode | Description |
62+|--------|------|-------------|
63+| Only `token_secret` | Token-only | JWT tokens for all access |
64+| `token_secret` + `username` + `password_hash` | Password + Token | Password for interactive login, tokens for CI/CD |
65+
66+Tokens always work regardless of mode. The difference is whether password authentication is available.
54 67
55 ## Environment Variables68 ## Environment Variables
56 69
@@ -81,14 +94,13 @@ See [Secret Providers](./secrets.md) for detailed configuration of each backend.
81 94
82 ## Authentication Types95 ## Authentication Types
83 96
84-### Token Authentication (Recommended)97+### Token-Only Mode
85 98
86-JWT-based authentication, ideal for CI/CD pipelines:99+JWT-based authentication, ideal for CI/CD pipelines when you don't need interactive login:
87 100
88 ```toml101 ```toml
89 [auth]102 [auth]
90 enabled = true103 enabled = true
91-type = "token"
92 secrets_backend = "pass"104 secrets_backend = "pass"
93 token_secret = "gordon/auth/token_secret"105 token_secret = "gordon/auth/token_secret"
94 token_expiry = "30d"106 token_expiry = "30d"
@@ -121,19 +133,21 @@ gordon auth token revoke <token-id>
121 gordon auth token revoke --all133 gordon auth token revoke --all
122 ```134 ```
123 135
124-### Password Authentication136+### Password + Token Mode
125 137
126-Simple username/password authentication:138+Password authentication for interactive login, plus tokens for CI/CD:
127 139
128 ```toml140 ```toml
129 [auth]141 [auth]
130 enabled = true142 enabled = true
131-type = "password"
132 secrets_backend = "pass"143 secrets_backend = "pass"
133 username = "deploy"144 username = "deploy"
134 password_hash = "gordon/auth/password_hash"145 password_hash = "gordon/auth/password_hash"
146+token_secret = "gordon/auth/token_secret"
135 ```147 ```
136 148
149+When `username` and `password_hash` are configured, both password and token authentication work.
150+
137 **Setup:**151 **Setup:**
138 ```bash152 ```bash
139 # Generate bcrypt hash153 # Generate bcrypt hash
@@ -143,13 +157,36 @@ gordon auth password hash
143 # Store hash in secrets backend157 # Store hash in secrets backend
144 pass insert gordon/auth/password_hash158 pass insert gordon/auth/password_hash
145 # Paste the bcrypt hash159 # Paste the bcrypt hash
160+
161+# Create token secret (for CI/CD token generation)
162+pass insert gordon/auth/token_secret
163+# Enter a random 32+ character string
146 ```164 ```
147 165
148 **Usage:**166 **Usage:**
149 ```bash167 ```bash
168+# Docker registry access
150 docker login -u deploy -p <password> registry.mydomain.com169 docker login -u deploy -p <password> registry.mydomain.com
170+
171+# Remote CLI authentication
172+gordon auth login --remote prod
173+# Enter username and password when prompted
151 ```174 ```
152 175
176+**Remote CLI Authentication:**
177+
178+With password authentication enabled, you can use `gordon auth login` to obtain a token for remote CLI operations:
179+
180+```bash
181+gordon auth login --remote prod
182+# Username: deploy
183+# Password: ********
184+# ✓ Authentication successful!
185+# Token stored for remote 'prod'
186+```
187+
188+The returned token is stored automatically and used for subsequent CLI commands.
189+
153 ## Token Scopes190 ## Token Scopes
154 191
155 Tokens can have different permission levels:192 Tokens can have different permission levels:
@@ -232,12 +269,11 @@ enabled = false
232 269
233 ## Examples270 ## Examples
234 271
235-### CI/CD Setup272+### CI/CD Setup (Token-Only)
236 273
237 ```toml274 ```toml
238 [auth]275 [auth]
239 enabled = true276 enabled = true
240-type = "token"
241 secrets_backend = "pass"277 secrets_backend = "pass"
242 token_secret = "gordon/auth/token_secret"278 token_secret = "gordon/auth/token_secret"
243 ```279 ```
@@ -253,15 +289,15 @@ In GitHub Actions:
253 run: docker login -u github-actions -p ${{ secrets.GORDON_TOKEN }} ${{ secrets.GORDON_REGISTRY }}289 run: docker login -u github-actions -p ${{ secrets.GORDON_TOKEN }} ${{ secrets.GORDON_REGISTRY }}
254 ```290 ```
255 291
256-### Production with Password292+### Production with Password + Token
257 293
258 ```toml294 ```toml
259 [auth]295 [auth]
260 enabled = true296 enabled = true
261-type = "password"
262 secrets_backend = "pass"297 secrets_backend = "pass"
263 username = "deploy"298 username = "deploy"
264 password_hash = "gordon/auth/password_hash"299 password_hash = "gordon/auth/password_hash"
300+token_secret = "gordon/auth/token_secret"
265 ```301 ```
266 302
267 ### Enterprise with SOPS303 ### Enterprise with SOPS
@@ -269,7 +305,6 @@ password_hash = "gordon/auth/password_hash"
269 ```toml305 ```toml
270 [auth]306 [auth]
271 enabled = true307 enabled = true
272-type = "token"
273 secrets_backend = "sops"308 secrets_backend = "sops"
274 token_secret = "gordon/auth/token_secret"309 token_secret = "gordon/auth/token_secret"
275 ```310 ```
M docs/config/index.md +3 -6
@@ -38,14 +38,12 @@ gordon_domain = "gordon.mydomain.com" # Required: Gordon domain (registry + A
3838 # Authentication (includes secrets backend)
3939 [auth]
4040 enabled = true # Enable registry authentication (default: true)
41-type = "token" # "password" or "token"
4241 secrets_backend = "pass" # "pass", "sops", or "unsafe"
43-# Password auth:
42+token_secret = "gordon/auth/token_secret" # Required: JWT signing secret
43+token_expiry = "30d" # Duration (1y, 30d, 2w) or 0 for never
44+# Optional: enable password authentication (for interactive login)
4445 # username = "deploy"
4546 # password_hash = "gordon/auth/password_hash"
46-# Token auth:
47-token_secret = "gordon/auth/token_secret"
48-token_expiry = "30d" # Duration (1y, 30d, 2w) or 0 for never
4947
5048 # API rate limiting
5149 [api.rate_limit]
@@ -139,7 +137,6 @@ enabled = false # Auto-create routes from image names
139137 | `server.registry_port` | `5000` |
140138 | `server.data_dir` | `~/.gordon` |
141139 | `auth.enabled` | `true` |
142-| `auth.type` | `"password"` |
143140 | `auth.secrets_backend` | `"unsafe"` |
144141 | `auth.token_expiry` | `"30d"` |
145142 | `api.rate_limit.enabled` | `true` |
@@ -38,14 +38,12 @@ gordon_domain = "gordon.mydomain.com" # Required: Gordon domain (registry + A
38 # Authentication (includes secrets backend)38 # Authentication (includes secrets backend)
39 [auth]39 [auth]
40 enabled = true # Enable registry authentication (default: true)40 enabled = true # Enable registry authentication (default: true)
41-type = "token" # "password" or "token"
42 secrets_backend = "pass" # "pass", "sops", or "unsafe"41 secrets_backend = "pass" # "pass", "sops", or "unsafe"
43-# Password auth:42+token_secret = "gordon/auth/token_secret" # Required: JWT signing secret
43+token_expiry = "30d" # Duration (1y, 30d, 2w) or 0 for never
44+# Optional: enable password authentication (for interactive login)
44 # username = "deploy"45 # username = "deploy"
45 # password_hash = "gordon/auth/password_hash"46 # password_hash = "gordon/auth/password_hash"
46-# Token auth:
47-token_secret = "gordon/auth/token_secret"
48-token_expiry = "30d" # Duration (1y, 30d, 2w) or 0 for never
49 47
50 # API rate limiting48 # API rate limiting
51 [api.rate_limit]49 [api.rate_limit]
@@ -139,7 +137,6 @@ enabled = false # Auto-create routes from image names
139 | `server.registry_port` | `5000` |137 | `server.registry_port` | `5000` |
140 | `server.data_dir` | `~/.gordon` |138 | `server.data_dir` | `~/.gordon` |
141 | `auth.enabled` | `true` |139 | `auth.enabled` | `true` |
142-| `auth.type` | `"password"` |
143 | `auth.secrets_backend` | `"unsafe"` |140 | `auth.secrets_backend` | `"unsafe"` |
144 | `auth.token_expiry` | `"30d"` |141 | `auth.token_expiry` | `"30d"` |
145 | `api.rate_limit.enabled` | `true` |142 | `api.rate_limit.enabled` | `true` |
M docs/config/reference.md +4 -13
@@ -19,12 +19,12 @@ data_dir = "~/.gordon" # Data directory (varies by install
1919 # =============================================================================
2020 [auth]
2121 enabled = true # Enable registry authentication (default: true)
22-type = "password" # "password" or "token"
2322 secrets_backend = "unsafe" # "pass", "sops", or "unsafe"
24-username = "" # Username for password auth
25-password_hash = "" # Path in secrets backend to bcrypt hash (REQUIRED for password type)
26-token_secret = "" # Path in secrets backend to JWT signing key (REQUIRED for token type)
23+token_secret = "" # Path in secrets backend to JWT signing key (REQUIRED)
2724 token_expiry = "720h" # Token expiry duration (720h = 30 days)
25+# Optional: enable password authentication (for interactive login)
26+# username = "" # Username for password auth
27+# password_hash = "" # Path in secrets backend to bcrypt hash
2828
2929 # =============================================================================
3030 # API (applies to both Registry and Admin endpoints)
@@ -126,7 +126,6 @@ preserve = true # Keep volumes when containers are
126126 | `server.gordon_domain` | `""` | **Required** - Gordon domain |
127127 | `server.data_dir` | `~/.gordon` | Data directory |
128128 | `auth.enabled` | `true` | Enable authentication |
129-| `auth.type` | `"password"` | Auth type |
130129 | `auth.secrets_backend` | `"unsafe"` | Secrets storage |
131130 | `auth.token_expiry` | `"720h"` | 30 days |
132131 | `api.rate_limit.enabled` | `true` | Enable rate limiting |
@@ -166,7 +165,6 @@ Examples:
166165 GORDON_SERVER_PORT=8080
167166 GORDON_SERVER_GORDON_DOMAIN=gordon.example.com
168167 GORDON_AUTH_ENABLED=true
169-GORDON_AUTH_TYPE=token
170168 GORDON_LOGGING_LEVEL=debug
171169 GORDON_NETWORK_ISOLATION_ENABLED=true
172170 ```
@@ -200,13 +198,6 @@ gordon serve
200198 | `"if-tag-changed"` | Pull only if image tag differs from running container |
201199 | `"never"` | Never pull, use local image only |
202200
203-## Auth Type Options
204-
205-| Value | Description |
206-|-------|-------------|
207-| `"password"` | HTTP Basic authentication with username/password |
208-| `"token"` | JWT token authentication |
209-
210201 ## Secrets Backend Options
211202
212203 | Value | Description |
@@ -19,12 +19,12 @@ data_dir = "~/.gordon" # Data directory (varies by install
19 # =============================================================================19 # =============================================================================
20 [auth]20 [auth]
21 enabled = true # Enable registry authentication (default: true)21 enabled = true # Enable registry authentication (default: true)
22-type = "password" # "password" or "token"
23 secrets_backend = "unsafe" # "pass", "sops", or "unsafe"22 secrets_backend = "unsafe" # "pass", "sops", or "unsafe"
24-username = "" # Username for password auth23+token_secret = "" # Path in secrets backend to JWT signing key (REQUIRED)
25-password_hash = "" # Path in secrets backend to bcrypt hash (REQUIRED for password type)
26-token_secret = "" # Path in secrets backend to JWT signing key (REQUIRED for token type)
27 token_expiry = "720h" # Token expiry duration (720h = 30 days)24 token_expiry = "720h" # Token expiry duration (720h = 30 days)
25+# Optional: enable password authentication (for interactive login)
26+# username = "" # Username for password auth
27+# password_hash = "" # Path in secrets backend to bcrypt hash
28 28
29 # =============================================================================29 # =============================================================================
30 # API (applies to both Registry and Admin endpoints)30 # API (applies to both Registry and Admin endpoints)
@@ -126,7 +126,6 @@ preserve = true # Keep volumes when containers are
126 | `server.gordon_domain` | `""` | **Required** - Gordon domain |126 | `server.gordon_domain` | `""` | **Required** - Gordon domain |
127 | `server.data_dir` | `~/.gordon` | Data directory |127 | `server.data_dir` | `~/.gordon` | Data directory |
128 | `auth.enabled` | `true` | Enable authentication |128 | `auth.enabled` | `true` | Enable authentication |
129-| `auth.type` | `"password"` | Auth type |
130 | `auth.secrets_backend` | `"unsafe"` | Secrets storage |129 | `auth.secrets_backend` | `"unsafe"` | Secrets storage |
131 | `auth.token_expiry` | `"720h"` | 30 days |130 | `auth.token_expiry` | `"720h"` | 30 days |
132 | `api.rate_limit.enabled` | `true` | Enable rate limiting |131 | `api.rate_limit.enabled` | `true` | Enable rate limiting |
@@ -166,7 +165,6 @@ Examples:
166 GORDON_SERVER_PORT=8080165 GORDON_SERVER_PORT=8080
167 GORDON_SERVER_GORDON_DOMAIN=gordon.example.com166 GORDON_SERVER_GORDON_DOMAIN=gordon.example.com
168 GORDON_AUTH_ENABLED=true167 GORDON_AUTH_ENABLED=true
169-GORDON_AUTH_TYPE=token
170 GORDON_LOGGING_LEVEL=debug168 GORDON_LOGGING_LEVEL=debug
171 GORDON_NETWORK_ISOLATION_ENABLED=true169 GORDON_NETWORK_ISOLATION_ENABLED=true
172 ```170 ```
@@ -200,13 +198,6 @@ gordon serve
200 | `"if-tag-changed"` | Pull only if image tag differs from running container |198 | `"if-tag-changed"` | Pull only if image tag differs from running container |
201 | `"never"` | Never pull, use local image only |199 | `"never"` | Never pull, use local image only |
202 200
203-## Auth Type Options
204-
205-| Value | Description |
206-|-------|-------------|
207-| `"password"` | HTTP Basic authentication with username/password |
208-| `"token"` | JWT token authentication |
209-
210 ## Secrets Backend Options201 ## Secrets Backend Options
211 202
212 | Value | Description |203 | Value | Description |
M docs/config/secrets.md +0 -2
@@ -139,7 +139,6 @@ API_SECRET=${sops:production.yaml:api.secret.key}
139139 ```toml
140140 [auth]
141141 enabled = true
142-type = "token"
143142 secrets_backend = "pass"
144143 token_secret = "gordon/auth/token_secret"
145144 ```
@@ -166,7 +165,6 @@ secrets_backend = "unsafe"
166165 ```toml
167166 [auth]
168167 enabled = true
169-type = "token"
170168 secrets_backend = "sops"
171169 token_secret = "gordon/auth/token_secret"
172170 ```
@@ -139,7 +139,6 @@ API_SECRET=${sops:production.yaml:api.secret.key}
139 ```toml139 ```toml
140 [auth]140 [auth]
141 enabled = true141 enabled = true
142-type = "token"
143 secrets_backend = "pass"142 secrets_backend = "pass"
144 token_secret = "gordon/auth/token_secret"143 token_secret = "gordon/auth/token_secret"
145 ```144 ```
@@ -166,7 +165,6 @@ secrets_backend = "unsafe"
166 ```toml165 ```toml
167 [auth]166 [auth]
168 enabled = true167 enabled = true
169-type = "token"
170 secrets_backend = "sops"168 secrets_backend = "sops"
171 token_secret = "gordon/auth/token_secret"169 token_secret = "gordon/auth/token_secret"
172 ```170 ```
M wiki/examples/index.md +0 -1
@@ -46,7 +46,6 @@ gordon_domain = "gordon.company.com"
4646
4747 [auth]
4848 enabled = true
49-type = "token"
5049 secrets_backend = "pass"
5150 token_secret = "gordon/auth/token_secret"
5251
@@ -46,7 +46,6 @@ gordon_domain = "gordon.company.com"
46 46
47 [auth]47 [auth]
48 enabled = true48 enabled = true
49-type = "token"
50 secrets_backend = "pass"49 secrets_backend = "pass"
51 token_secret = "gordon/auth/token_secret"50 token_secret = "gordon/auth/token_secret"
52 51
M wiki/examples/production.md +0 -1
@@ -22,7 +22,6 @@ gordon_domain = "gordon.company.com"
2222 # Authentication with pass backend (recommended)
2323 [auth]
2424 enabled = true
25-type = "token"
2625 secrets_backend = "pass"
2726 token_secret = "gordon/auth/token_secret"
2827
@@ -22,7 +22,6 @@ gordon_domain = "gordon.company.com"
22 # Authentication with pass backend (recommended)22 # Authentication with pass backend (recommended)
23 [auth]23 [auth]
24 enabled = true24 enabled = true
25-type = "token"
26 secrets_backend = "pass"25 secrets_backend = "pass"
27 token_secret = "gordon/auth/token_secret"26 token_secret = "gordon/auth/token_secret"
28 27
M wiki/guides/remote-cli.md +31 -0
@@ -151,6 +151,37 @@ gordon remotes add prod https://gordon.mydomain.com --token-env PROD_TOKEN
151151 | `--token <TOKEN>` | Store token directly in config |
152152 | `--token-env <VAR>` | Store env variable name (token resolved at runtime) |
153153
154+#### Authenticate with Password Auth
155+
156+For servers using password authentication, you can log in interactively:
157+
158+```bash
159+# Login to active remote
160+gordon auth login
161+
162+# Login to specific remote
163+gordon auth login --remote prod
164+
165+# Pre-fill username
166+gordon auth login --username admin
167+```
168+
169+This prompts for your username and password, authenticates with the remote server, and stores the returned token automatically.
170+
171+> **Note:** Only works with servers that have password authentication enabled (`username` + `password_hash` configured). For token-only servers, use `gordon remotes set-token` instead.
172+
173+#### Set Token Manually
174+
175+For servers using token-based auth, or to update a token manually:
176+
177+```bash
178+# Set token directly
179+gordon remotes set-token prod eyJhbGciOiJIUzI1NiIs...
180+
181+# Set token from file
182+gordon remotes set-token staging $(cat token.txt)
183+```
184+
154185 #### Remove a Remote
155186
156187 ```bash
@@ -151,6 +151,37 @@ gordon remotes add prod https://gordon.mydomain.com --token-env PROD_TOKEN
151 | `--token <TOKEN>` | Store token directly in config |151 | `--token <TOKEN>` | Store token directly in config |
152 | `--token-env <VAR>` | Store env variable name (token resolved at runtime) |152 | `--token-env <VAR>` | Store env variable name (token resolved at runtime) |
153 153
154+#### Authenticate with Password Auth
155+
156+For servers using password authentication, you can log in interactively:
157+
158+```bash
159+# Login to active remote
160+gordon auth login
161+
162+# Login to specific remote
163+gordon auth login --remote prod
164+
165+# Pre-fill username
166+gordon auth login --username admin
167+```
168+
169+This prompts for your username and password, authenticates with the remote server, and stores the returned token automatically.
170+
171+> **Note:** Only works with servers that have password authentication enabled (`username` + `password_hash` configured). For token-only servers, use `gordon remotes set-token` instead.
172+
173+#### Set Token Manually
174+
175+For servers using token-based auth, or to update a token manually:
176+
177+```bash
178+# Set token directly
179+gordon remotes set-token prod eyJhbGciOiJIUzI1NiIs...
180+
181+# Set token from file
182+gordon remotes set-token staging $(cat token.txt)
183+```
184+
154 #### Remove a Remote185 #### Remove a Remote
155 186
156 ```bash187 ```bash
M wiki/guides/running-in-container.md +3 -3
@@ -309,11 +309,11 @@ volumes:
309309 ```toml
310310 [auth]
311311 enabled = true
312-type = "token"
313312 secrets_backend = "pass"
314-username = "admin"
315-password_hash = "gordon/auth/password_hash"
316313 token_secret = "gordon/auth/token_secret"
314+# Optional: enable password auth for interactive login
315+# username = "admin"
316+# password_hash = "gordon/auth/password_hash"
317317 ```
318318
319319 ### GPG Agent (Optional)
@@ -309,11 +309,11 @@ volumes:
309 ```toml309 ```toml
310 [auth]310 [auth]
311 enabled = true311 enabled = true
312-type = "token"
313 secrets_backend = "pass"312 secrets_backend = "pass"
314-username = "admin"
315-password_hash = "gordon/auth/password_hash"
316 token_secret = "gordon/auth/token_secret"313 token_secret = "gordon/auth/token_secret"
314+# Optional: enable password auth for interactive login
315+# username = "admin"
316+# password_hash = "gordon/auth/password_hash"
317 ```317 ```
318 318
319 ### GPG Agent (Optional)319 ### GPG Agent (Optional)
M wiki/guides/secrets-pass.md +3 -3
@@ -99,11 +99,11 @@ pass generate gordon/auth/token_secret 32
9999 ```toml
100100 [auth]
101101 enabled = true
102-type = "token"
103102 secrets_backend = "pass"
104-username = "admin"
105-password_hash = "gordon/auth/password_hash"
106103 token_secret = "gordon/auth/token_secret"
104+# Optional: enable password auth for interactive login
105+# username = "admin"
106+# password_hash = "gordon/auth/password_hash"
107107 ```
108108
109109 ### Using Secrets in Environment Files
@@ -99,11 +99,11 @@ pass generate gordon/auth/token_secret 32
99 ```toml99 ```toml
100 [auth]100 [auth]
101 enabled = true101 enabled = true
102-type = "token"
103 secrets_backend = "pass"102 secrets_backend = "pass"
104-username = "admin"
105-password_hash = "gordon/auth/password_hash"
106 token_secret = "gordon/auth/token_secret"103 token_secret = "gordon/auth/token_secret"
104+# Optional: enable password auth for interactive login
105+# username = "admin"
106+# password_hash = "gordon/auth/password_hash"
107 ```107 ```
108 108
109 ### Using Secrets in Environment Files109 ### Using Secrets in Environment Files
M wiki/guides/secrets-sops.md +3 -3
@@ -197,11 +197,11 @@ sops edit secrets.yaml
197197 ```toml
198198 [auth]
199199 enabled = true
200-type = "token"
201200 secrets_backend = "sops"
202-username = "admin"
203-password_hash = "secrets.yaml:auth.password_hash"
204201 token_secret = "secrets.yaml:auth.token_secret"
202+# Optional: enable password auth for interactive login
203+# username = "admin"
204+# password_hash = "secrets.yaml:auth.password_hash"
205205 ```
206206
207207 The path format is `file:key.path` where:
@@ -197,11 +197,11 @@ sops edit secrets.yaml
197 ```toml197 ```toml
198 [auth]198 [auth]
199 enabled = true199 enabled = true
200-type = "token"
201 secrets_backend = "sops"200 secrets_backend = "sops"
202-username = "admin"
203-password_hash = "secrets.yaml:auth.password_hash"
204 token_secret = "secrets.yaml:auth.token_secret"201 token_secret = "secrets.yaml:auth.token_secret"
202+# Optional: enable password auth for interactive login
203+# username = "admin"
204+# password_hash = "secrets.yaml:auth.password_hash"
205 ```205 ```
206 206
207 The path format is `file:key.path` where:207 The path format is `file:key.path` where:

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close