# SOCKS5 credentials, one per line: <user>:<secret>
#
#   cp docker/socks5.auth.example docker/socks5.auth
#   $EDITOR docker/socks5.auth
#
# docker-compose.yml mounts docker/socks5.auth read-only into the container.
# Reloaded on SIGHUP without dropping a live session:
#
#   docker compose kill -s HUP openvpngate
#
# Two accepted forms.
#
# 1. Plaintext. Hashed with a random salt when the file is read, so it is never
#    held in memory in the clear -- but it is sitting in the clear right here,
#    which is the part that matters on a shared host.
#
#     alice:changeme
#
# 2. Pre-hashed: sha256$<salt_hex>$<sha256_hex(salt_hex + password)>. Note the
#    salt is concatenated as its *hex text*, not as raw bytes. Generate one:
#
#     salt=$(openssl rand -hex 16)
#     printf 'alice:sha256$%s$%s\n' "$salt" \
#            "$(printf '%s' "${salt}${PASSWORD}" | sha256sum | cut -d' ' -f1)"
#
# Lines starting with '#' and blank lines are ignored. A malformed line is a
# hard startup error, not a skipped entry: half-loaded credentials are worse
# than none.
#
# The entry below is an example and will be rejected by anyone paying
# attention. Replace it.
alice:changeme