From ec70060ae5fa665953741da921e28031b56bc5e0 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: auth: logging in, and tokens as bearers POST /auth/login (by htpasswd or the proxy), /auth/refresh, /auth/logout, GET /auth/whoami; every request may bring Authorization: Bearer instead of a password. --token-lifetime and --session-lifetime. Auth plan M2. --- docs/example.toml | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'docs/example.toml') diff --git a/docs/example.toml b/docs/example.toml index b98752d..ab8237c 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -73,6 +73,15 @@ htpasswd = "/etc/continuum/htpasswd" # 0: never. # stream-heartbeat = "30s" +# How long a token this node issues (POST /auth/login, /auth/refresh) is taken, by every +# node of the swarm (docs/access.md, Tokens). Refreshed before it ends, it lasts until +# the login's end (session-lifetime). +# token-lifetime = "12h" + +# How long after a login (POST /auth/login) its tokens may be refreshed; then the user +# logs in again. +# session-lifetime = "7d" + # Where the reverse proxies whose user-header is believed connect from: IP addresses (or # ranges, as ADDRESS/BITS), and unix for the API's Unix sockets (bind-addr). On a host # with other users, leave out the addresses and have the proxy use a Unix socket: others -- cgit v1.3.1