docs: explain SECRET_KEY env variable in README - #200
Conversation
Document what SECRET_KEY is for: a server-side pepper used as the HMAC key when hashing user passwords. Note that it must be a long random string, kept private, and held constant since changing it invalidates all existing password hashes. Closes #129 Signed-off-by: Mark Rivera <mcrivera@gmail.com>
f36ca70 to
3ff1ab0
Compare
|
There was a problem hiding this comment.
nonblocking: do you want to put the detailed explanations of the envvars in here or outsource those explanations to a wiki page like we do for Heimdall?
There was a problem hiding this comment.
That a good point and I don't really know. We have the readme, soon we will have the example .env and we have the TIR docs site.
There was a problem hiding this comment.
IMO the example .env is super rough / basically just a list of the envvars so folks can more easily comment them in/out with the bare minimum amount of info you need to make a decision.
For us the wiki page is where we put the very in-depth + formatted explanation for everything.
Since it's a form of extended documentation, I think the TIR docs site could be a good place too.
2 participants
Summary
Documents what the SECRET_KEY environment variable is for, so operators know how to set it and what happens if they change it.
Changes
Testing
Documentation only; checked rendereing
Related
Closes #129 (review request from @Amndeep7 on #10 discussion).