docs: remove stale password auth references

Password login was removed in v2.30.0. Clean up references to
password_hash config, password auth in remotes, and pass store
examples that still showed password_hash.

commit: 3ef732b30640dfe9fc182aa3583571b310ecdab3
author: brice · 6mo ago · 2026-03-28 08:15 UTC
parent: 06c2247
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

4 files · +4 -12

M docs/cli/remotes.md +0 -3


@@ -195,12 +195,9 @@ gordon remotes set-token <name> <token>
195	195
196	196		This command is useful when:
197	197
198		-	- The server uses token-based authentication (not password auth)
199	198		- You have a pre-generated token from `gordon auth token generate`
200	199		- You want to update an expired token
201	200
202		-	For servers with password authentication, use `gordon auth login` instead.
203		-
204	201		### Examples
205	202
206	203		```bash


@@ -195,12 +195,9 @@ gordon remotes set-token <name> <token>
195			195
196		This command is useful when:	196	This command is useful when:
197			197
198	-	- The server uses token-based authentication (not password auth)
199		- You have a pre-generated token from `gordon auth token generate`	198	- You have a pre-generated token from `gordon auth token generate`
200		- You want to update an expired token	199	- You want to update an expired token
201			200
202	-	For servers with password authentication, use `gordon auth login` instead.
203	-
204		### Examples	201	### Examples
205			202
206		```bash	203	```bash

M docs/config/index.md +1 -3


@@ -41,9 +41,7 @@ enabled = true # Enable registry authentication (defau
41	41		secrets_backend = "pass" # "pass", "sops", or "unsafe"
42	42		token_secret = "gordon/auth/token_secret" # Required: JWT signing secret
43	43		token_expiry = "30d" # Duration (1y, 30d, 2w) or 0 for never
44		-	# Optional: enable password authentication (for interactive login)
45		-	# username = "deploy"
46		-	# password_hash = "gordon/auth/password_hash"
	44	+	# Token-only authentication (password login was removed in v2.30.0)
47	45
48	46		# API rate limiting
49	47		[api.rate_limit]

 secrets_backend = "pass"                 # "pass", "sops", or "unsafe"
 token_secret = "gordon/auth/token_secret"  # Required: JWT signing secret
 token_expiry = "30d"                     # Duration (1y, 30d, 2w) or 0 for never
-# Optional: enable password authentication (for interactive login)
+# Token-only authentication (password login was removed in v2.30.0)
-# username = "deploy"
-# password_hash = "gordon/auth/password_hash"
 # API rate limiting
 [api.rate_limit]

M docs/config/secrets.md +2 -5


@@ -37,15 +37,13 @@ sudo apt install pass
37	37		pass init your-gpg-key-id
38	38
39	39		# Store secrets
40		-	pass insert gordon/auth/password_hash
41	40		pass insert gordon/auth/token_secret
42	41		```
43	42
44	43		Usage in config:
45	44		```toml
46	45		[auth]
47		-	password_hash = "gordon/auth/password_hash" # Path in pass store
48		-	token_secret = "gordon/auth/token_secret"
	46	+	token_secret = "gordon/auth/token_secret" # Path in pass store
49	47		```
50	48
51	49		Benefits:

@@ -119,7 +117,6 @@ secrets_backend = "unsafe"
119	117		{data_dir}/secrets/
120	118		├── gordon/
121	119		│ └── auth/
122		-	│ ├── password_hash
123	120		│ └── token_secret
124	121		```
125	122

@@ -132,7 +129,7 @@ secrets_backend = "unsafe"
132	129		```bash
133	130		# Create secret
134	131		mkdir -p ~/.gordon/secrets/gordon/auth
135		-	echo "your-bcrypt-hash" > ~/.gordon/secrets/gordon/auth/password_hash
	132	+	echo "your-token-secret" > ~/.gordon/secrets/gordon/auth/token_secret
136	133		```
137	134
138	135		> Warning: Only use for local development. Secrets are stored in plain text.

 pass init your-gpg-key-id
 # Store secrets
-pass insert gordon/auth/password_hash
 pass insert gordon/auth/token_secret
 ```
 **Usage in config:**
 ```toml
 [auth]
-password_hash = "gordon/auth/password_hash"  # Path in pass store
+token_secret = "gordon/auth/token_secret"  # Path in pass store
-token_secret = "gordon/auth/token_secret"
 ```
 **Benefits:**
 {data_dir}/secrets/
 ├── gordon/
 │   └── auth/
-│       ├── password_hash
 │       └── token_secret
 ```
 ```bash
 # Create secret
 mkdir -p ~/.gordon/secrets/gordon/auth
-echo "your-bcrypt-hash" > ~/.gordon/secrets/gordon/auth/password_hash
+echo "your-token-secret" > ~/.gordon/secrets/gordon/auth/token_secret
 ```
 > **Warning:** Only use for local development. Secrets are stored in plain text.

M docs/upgrading.md +1 -1


@@ -187,7 +187,7 @@ This is intentional to encourage secure secret storage in production. The warnin
187	187		### New Features
188	188
189	189		- Attachment secrets discovery: `gordon secrets list <domain>` now shows secrets for attachment containers
190		-	- Auth login command: `gordon auth login --remote <name>` for password authentication
	190	+	- Auth login command: `gordon auth login --remote <name>` for token authentication
191	191		- Rate limiting: Configurable rate limits under `[api.rate_limit]`
192	192
193	193		### Security Improvements


@@ -187,7 +187,7 @@ This is intentional to encourage secure secret storage in production. The warnin
187		### New Features	187		### New Features
188			188
189		- Attachment secrets discovery: `gordon secrets list <domain>` now shows secrets for attachment containers	189		- Attachment secrets discovery: `gordon secrets list <domain>` now shows secrets for attachment containers
190	-	- Auth login command: `gordon auth login --remote <name>` for password authentication	190	+	- Auth login command: `gordon auth login --remote <name>` for token authentication
191		- Rate limiting: Configurable rate limits under `[api.rate_limit]`	191		- Rate limiting: Configurable rate limits under `[api.rate_limit]`
192			192
193		### Security Improvements	193		### Security Improvements