docs(auth): clarify token secret sources

2 files · +7 -2

M docs/config/auth.md +1 -1


@@ -54,7 +54,7 @@ See [Secret Providers](./secrets.md) for setup details.
54	54
55	55		## Environment Variable
56	56
57		-	`GORDON_AUTH_TOKEN_SECRET` overrides `token_secret` in the config.
	57	+	`GORDON_AUTH_TOKEN_SECRET` overrides `token_secret` in the config. If you don’t set the env var, `token_secret` is loaded from the configured secrets backend (including `pass`).
58	58
59	59		```bash
60	60		export GORDON_AUTH_TOKEN_SECRET="your-32-character-secret-here"


@@ -54,7 +54,7 @@ See [Secret Providers](./secrets.md) for setup details.
54			54
55		## Environment Variable	55		## Environment Variable
56			56
57	-	`GORDON_AUTH_TOKEN_SECRET` overrides `token_secret` in the config.	57	+	`GORDON_AUTH_TOKEN_SECRET` overrides `token_secret` in the config. If you don’t set the env var, `token_secret` is loaded from the configured secrets backend (including `pass`).
58			58
59		```bash	59		```bash
60		export GORDON_AUTH_TOKEN_SECRET="your-32-character-secret-here"	60		export GORDON_AUTH_TOKEN_SECRET="your-32-character-secret-here"

M docs/getting-started.md +6 -1


@@ -29,7 +29,7 @@ Config is created at `~/.config/gordon/gordon.toml`.
29	29
30	30		## 3. Set Up Authentication
31	31
32		-	Gordon requires a `token_secret` for JWT authentication. We recommend using `pass` to store secrets securely.
	32	+	Gordon requires a `token_secret` for JWT authentication. You can store it in `pass` or provide it via the `GORDON_AUTH_TOKEN_SECRET` environment variable. We recommend using `pass` to store secrets securely.
33	33
34	34		> Local development? If you just want to try Gordon locally, you can disable auth temporarily:
35	35		> ```toml

@@ -53,6 +53,11 @@ pass init <your-gpg-key-id>
53	53		openssl rand -base64 32 \| pass insert -m gordon/auth/token_secret
54	54		```
55	55
	56	+	Or set it via environment variable:
	57	+	```bash
	58	+	export GORDON_AUTH_TOKEN_SECRET="your-32-character-secret-here"
	59	+	```
	60	+
56	61		Update your config (`~/.config/gordon/gordon.toml`):
57	62		```toml
58	63		[auth]

 ## 3. Set Up Authentication
-Gordon requires a `token_secret` for JWT authentication. We recommend using `pass` to store secrets securely.
+Gordon requires a `token_secret` for JWT authentication. You can store it in `pass` or provide it via the `GORDON_AUTH_TOKEN_SECRET` environment variable. We recommend using `pass` to store secrets securely.
 > **Local development?** If you just want to try Gordon locally, you can disable auth temporarily:
 > ```toml
 openssl rand -base64 32 | pass insert -m gordon/auth/token_secret
 ```
+**Or set it via environment variable:**
+```bash
+export GORDON_AUTH_TOKEN_SECRET="your-32-character-secret-here"
+```
 **Update your config** (`~/.config/gordon/gordon.toml`):
 ```toml
 [auth]