valknar/triggershell
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Store password/token hashes in .env by default too

Browse Source 
triggershell users add/add-token now generate a TRIGGERSHELL_USER_<name>_
PASSWORD_HASH / TRIGGERSHELL_TOKEN_<name>_HASH variable in .env (creating
or updating it idempotently) and print a ${VAR} snippet to paste into
auth.users/auth.tokens, instead of printing the raw hash. Pass --inline to
get the old behavior, since a hash - unlike sessionSecret - is safe to
store directly in the config (same trust model as /etc/shadow); this just
gives people who don't want it there at all an easy option.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
valknar
2026-08-15 19:31:41 +02:00
co-authored by Claude Sonnet 5
parent 80c11d3bd3
commit ac0e645be3
5 changed files with 143 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CONFIG_REFERENCE.md
+8 -2
View File
@@ -28,11 +28,17 @@ it. `triggershell validate` runs the Python pre-flight checks below, then that f
| `enabled` | boolean | `true` | `false` disables login entirely |
| `sessionSecret` | string | — | Required, >= 32 chars, if `enabled`. Reference it via `${TRIGGERSHELL_SESSION_SECRET}` and set the real value in `.env`, not here |
| `sessionTtlHours` | number | `12` | Session cookie lifetime |
| `users` | array | `[]` | `{username, passwordHash}` — hash via `triggershell users add` |
| `tokens` | array | `[]` | `{name, tokenHash}` — hash via `triggershell users add-token` |
| `users` | array | `[]` | `{username, passwordHash}` — generate via `triggershell users add` |
| `tokens` | array | `[]` | `{name, tokenHash}` — generate via `triggershell users add-token` |
If `enabled: true`, at least one user or token must be configured.
`passwordHash`/`tokenHash` are one-way hashes, so storing them directly in the config is
reasonably safe (same trust model as `/etc/shadow`). By default `triggershell users add`/
`add-token` instead store the hash in `.env` and give you a `${VAR}` reference to put in the
config, named `TRIGGERSHELL_USER_<USERNAME>_PASSWORD_HASH` / `TRIGGERSHELL_TOKEN_<NAME>_HASH` —
pass `--inline` to those commands to get the raw hash printed for pasting into the config instead.
## `database`
| Field | Type | Default |