From f30b1a519771ac49e2b03640e742fdb0a246bd81 Mon Sep 17 00:00:00 2001 From: salmonik Date: Thu, 29 Oct 2026 22:22:27 +0100 Subject: v2.4.0: key stored credentials by certificate fingerprint --- docs/SERVER_SETUP.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'docs/SERVER_SETUP.md') diff --git a/docs/SERVER_SETUP.md b/docs/SERVER_SETUP.md index 62d1a9c..37d55b1 100644 --- a/docs/SERVER_SETUP.md +++ b/docs/SERVER_SETUP.md @@ -69,11 +69,19 @@ On first contact the client prints the SPKI fingerprint and pins it. If you regenerate the server identity, the client will reject the new key; run `forget-host` in the client if the change is intentional. +Credentials are stored against the pinned fingerprint, not the address. Log in +once through `127.0.0.1:11525` and connecting through the machine's LAN address +will authenticate automatically, because both addresses present the same key. +`forget-host` removes one address; the stored login is only dropped when the +last address for that key is forgotten. + ## Database The server creates `server.db` in the current directory on first use. It holds users, balances, and the per-game `plays` audit. The client keeps its own -`client.db` for host fingerprints and stored credentials. +`client.db` for host fingerprints and stored credentials. Databases from before +the fingerprint-keyed credentials are migrated on startup; rows whose host was +already forgotten cannot be re-keyed and require one fresh login. During development, delete both files to reset users, balances, history, and trust: -- cgit v1.2.3