Authentication

Not everyone has an authentication service ready to go and Basic Auth provides a sub-par user experience. Therefore, journex provides a minimal single-user authentication implementation out of the box. Since journal data can be sensitive, authentication has to be disabled explicitly, if you do not want to use it. Otherwise, the username and password are configured via environment variables. Passwords can be pre-hashed to obfuscate them in configuration files.

# Disable authentication
JOURNEX_NO_AUTH=1 ./journex

# With plaintext password (hashed internally at startup)
JOURNEX_USER=admin JOURNEX_PASSWORD=mysecretpassword ./journex

# With pre-hashed password (recommended for production)
JOURNEX_USER=admin JOURNEX_PASSWORD_HASH=xxx ./journex

# To pre-hash your password use this command. It prompts on a terminal, and
# otherwise reads the password from stdin, so it never appears in your shell
# history or in `ps` output. The hash is printed to stdout.
./journex hash-password

Note that JOURNEX_PASSWORD is passed to journex as an environment variable, which other local users may be able to read. JOURNEX_PASSWORD_HASH is preferred in production.