Use interactive password prompt for argon2 hash generation

The bootstrap and add-user docs passed --password 'plaintext' on the
docker compose run command line, leaking the plaintext into shell
history (~/.bash_history, ~/.zsh_history) and the process list
(ps aux). Switched all three call sites to the interactive form
(no --password flag), which makes Authelia prompt for the password
and a confirmation without echoing.

Affected:
- README.md "Create your first user" step
- README.md "Add a user" section
- authelia/users_database.yml.example header comment

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
This commit is contained in:
Claude
2026-04-26 20:04:00 +00:00
parent 628d77563c
commit 18d5a40d32
2 changed files with 16 additions and 7 deletions
+7 -3
View File
@@ -2,13 +2,17 @@
###############################################################################
# Authelia users database
#
# Copy this to users_database.yml (gitignored) and edit. Generate the
# Copy this to users_database.yml (gitignored) and edit. Generate each
# password hash with:
#
# docker compose run --rm authelia \
# authelia crypto hash generate argon2 --password 'your-plaintext-pass'
# authelia crypto hash generate argon2
#
# Authelia prompts for the password and a confirmation without echoing,
# so the plaintext never hits shell history or `ps aux`. Output ends
# with `Digest: $argon2id$v=19$m=...`. Paste the digest (everything from
# `$argon2id` onward) as the `password:` value below.
#
# Paste the resulting `$argon2id$v=19$m=...` string as the `password:` value.
# Restart Authelia for changes to take effect (or wait refresh_interval).
###############################################################################