docs(config): document auth.admin_pa_file

content/cn/docs/config/config-authentication.md

@@ -92,6 +92,11 @@ auth.graph_store=hugegraph
 # Server 启动路径首次创建内置 admin 账号时使用，默认值为公开的 pa，生产部署前务必显式设置强密码
 # 本地持久化后端首次启用 StandardAuthenticator 时，init-store.sh 会交互式读取密码
 #auth.admin_pa=<your-admin-password>
+# 也可以从文件读取密码：按原始 UTF-8 读取（去掉开头的 BOM 和末尾一个换行符），空格、反斜杠和非 ASCII 字符无需转义
+# 设置后优先于 auth.admin_pa 和 init-store.sh 的交互式输入；必须是普通文件（会跟随符号链接），密码最多 72 个 UTF-8 字节
+# 使用 PD（hstore）和非持久化后端时每次启动都会读取该文件，设置该选项期间要保持文件可读
+# 仅适用于 1.7.0 之后的版本：更早版本的 Server 会忽略该配置项，仍需设置 auth.admin_pa
+#auth.admin_pa_file=/run/secrets/hugegraph-admin-password
 
 # auth client config
 # 如果是分开部署 GraphServer 和 AuthServer，还需要指定下面的配置，地址填写 AuthServer 的 IP:RPC 端口

content/cn/docs/config/config-backend-hstore.md

@@ -148,7 +148,7 @@ PD 对该值的处理方式：
 | graphspace                   | {graph}.properties     | DEFAULT        | PD 看到的图名的第一段                                             | `CoreOptions.java:679-685`   |
 
 `init-store.sh` 从不初始化 `hstore` 图。在开启的路径上，它扫描 `conf/graphs` 并跳过后端为 `hstore` 的每一个图。如果用 `init_store.enabled=false` 整体关闭这一步，它会改为校验 admin 账号仍然能在 PD 启动路径上被创建：
-`usePD` 必须为 true、权限图必须存在于本地配置中且后端为 `hstore`、`auth.admin_pa` 必须显式设置为非空值。否则启动会直接失败，而不是使用公开的默认密码创建账号。
+`usePD` 必须为 true、权限图必须存在于本地配置中且后端为 `hstore`、`auth.admin_pa` 必须显式设置为非空值，或者 `auth.admin_pa_file` 指向一个能通过 Server 启动时同样校验的文件（此时会立即读取该文件，文件有问题会在 Server 启动前报错）。否则启动会直接失败，而不是使用公开的默认密码创建账号。使用 PD 时 Server 每次启动都会再次读取 `auth.admin_pa_file`，而不只是首次启动，因此只要设置了该选项，就要保持文件可读。只有 1.7.0 之后的版本支持 `auth.admin_pa_file`；1.7.0 及更早版本的 Server 会忽略该配置项并只输出一条警告日志，仍按 `auth.admin_pa`（默认值为 `pa`）创建 admin 账号，因此在这些版本上仍需设置 `auth.admin_pa`。
 
 ### 6 Server 如何通过 PD 发现 Store
 

content/cn/docs/config/config-option.md

@@ -69,6 +69,7 @@ search_boost: 1.5
 | auth.authenticator                     |                                                  | The class path of authenticator implementation. e.g., org.apache.hugegraph.auth.StandardAuthenticator, or a custom implementation.                                                        |
 | auth.graph_store                       | hugegraph                                        | The name of graph used to store authentication information, like users, only for org.apache.hugegraph.auth.StandardAuthenticator.                                                                              |
 | auth.admin_pa                          | pa                                               | Server 启动路径初始化内置 admin 账户时使用，默认值为公开的 `pa`，生产部署前必须显式设置强密码。本地持久化后端首次初始化由 `init-store.sh` 交互式读取密码。                                                                                                                                                      |
+| auth.admin_pa_file                     |                                                  | 仅适用于 1.7.0 之后的版本。1.7.0 及更早版本的 Server 会忽略该配置项，只输出一条警告日志，仍然使用 `auth.admin_pa`（默认值为 `pa`）或 `init-store.sh` 的交互式输入，因此在这些版本上仍需设置 `auth.admin_pa`。存放内置 admin 账户初始密码的文件路径，必须是普通文件（会跟随符号链接）。文件按原始 UTF-8 读取，并去掉开头的 BOM 和末尾的一个换行符，因此空格、反斜杠和非 ASCII 字符无需按 properties 语法转义。密码按 UTF-8 编码最多 72 字节，超出部分不会参与密码哈希。设置后优先于 `auth.admin_pa` 和 `init-store.sh` 的交互式密码输入。文件不存在、不可读、不是普通文件、超过 4096 字节、不是合法 UTF-8、为空或密码超过 72 字节时，`init-store.sh` 或 Server 启动会失败。密码只在首次创建 admin 账户时使用，但使用 PD（hstore）和非持久化后端时，每次启动都会读取该文件，因此只要设置了该选项，就要保持文件可读。 |
 | auth.remote_url                        |                                                  | If the address is empty, it provide auth service, otherwise it is auth client and also provide auth service through rpc forwarding. The remote url can be set to multiple addresses, which are concat by ','. |
 | exception.allow_trace                  | true                                             | Whether to allow exception trace stack.                                                                                                                                                                       |
 | memory_monitor.threshold               | 0.85                                             | Threshold for JVM memory usage monitoring, 1 means disabling the memory monitoring task.                                                                                                                      |

content/en/docs/config/config-authentication.md

@@ -96,6 +96,12 @@ auth.graph_store=hugegraph
 # Used when Server first creates admin; replace public default pa with a strong password in production
 # For local persistent backends, init-store.sh prompts for a password when StandardAuthenticator is first initialized
 #auth.admin_pa=<your-admin-password>
+# Or read the password from a file as raw UTF-8 (a leading BOM and one trailing line break are dropped), so
+# spaces, backslashes and non-ASCII characters need no escaping; overrides auth.admin_pa and the init-store.sh prompt.
+# It must be a regular file (symlinks are followed), and the password may be at most 72 UTF-8 bytes.
+# PD (hstore) and non-persistent backends read it on every start, so keep it readable while it is set.
+# Versions after 1.7.0 only: older Servers ignore this key and still need auth.admin_pa
+#auth.admin_pa_file=/run/secrets/hugegraph-admin-password
 
 # Auth Client Config
 # If GraphServer and AuthServer are deployed separately, you also need to specify the following configuration. Fill in the IP:RPC port of AuthServer.

content/en/docs/config/config-backend-hstore.md

@@ -175,8 +175,13 @@ in the checked Server master commit `2f827d6` where the option is declared.
 `init-store.sh` never initializes an `hstore` graph. On the enabled path it scans `conf/graphs` and skips
 every graph whose backend is `hstore`. If you turn the whole step off with `init_store.enabled=false`, it
 validates instead that the admin account can still be created on the PD startup path: `usePD` has to be true,
-the auth graph has to exist locally with backend `hstore`, and `auth.admin_pa` has to be set to an explicit
-non-empty value. Otherwise startup fails rather than handing out the public default password.
+the auth graph has to exist locally with backend `hstore`, and either `auth.admin_pa` has to be set to an explicit
+non-empty value or `auth.admin_pa_file` has to name a file that passes the same checks as at Server startup.
+That file is read at this point, so a bad path fails before the Server starts. Otherwise startup fails rather
+than handing out the public default password. With PD the Server reads `auth.admin_pa_file` again on every
+start, not only the first one, so keep the file readable for as long as the option is set. Only versions after
+1.7.0 have `auth.admin_pa_file`. A 1.7.0 or earlier Server ignores it with a warning and creates the admin from
+`auth.admin_pa`, whose default is `pa`, so set `auth.admin_pa` on those versions.
 
 ### 6 How the Server finds the stores
 

content/en/docs/config/config-option.md

@@ -69,6 +69,7 @@ Corresponding configuration file `rest-server.properties`
 | auth.authenticator                     |                                                  | The class path of authenticator implementation. e.g., org.apache.hugegraph.auth.StandardAuthenticator, or a custom implementation.                                                        |
 | auth.graph_store                       | hugegraph                                        | The name of graph used to store authentication information, like users, only for org.apache.hugegraph.auth.StandardAuthenticator.                                                                              |
 | auth.admin_pa | pa | Used when the Server startup path initializes admin. Explicitly set a strong password before production deployment; the public default is `pa`. On local persistent backends, `init-store.sh` prompts for the initial password. |
+| auth.admin_pa_file | | Versions after 1.7.0 only. A 1.7.0 or earlier Server ignores this key, logging only a warning, and still uses `auth.admin_pa` (default `pa`) or the `init-store.sh` prompt, so set `auth.admin_pa` on those versions. Path of a regular file (symlinks are followed) holding the initial password for the built-in admin account. The file is read as raw UTF-8 with a leading BOM and one trailing line break removed, so spaces, backslashes and non-ASCII characters need no properties escaping. The password may be at most 72 bytes in UTF-8, because the password hash ignores anything after that. When set, it takes precedence over `auth.admin_pa` and the `init-store.sh` password prompt. A file that is missing, unreadable, not a regular file, larger than 4096 bytes, not valid UTF-8, empty, or holding a password longer than 72 bytes stops `init-store.sh` or Server startup. The password is only applied when the admin account is first created, but with PD (hstore) and non-persistent backends the file is read on every start, so keep it readable for as long as the option is set. |
 | auth.remote_url                        |                                                  | If the address is empty, it provide auth service, otherwise it is auth client and also provide auth service through rpc forwarding. The remote url can be set to multiple addresses, which are concat by ','. |
 | exception.allow_trace                  | true                                             | Whether to allow exception trace stack.                                                                                                                                                                       |
 | memory_monitor.threshold               | 0.85                                             | Threshold for JVM memory usage monitoring, 1 means disabling the memory monitoring task.                                                                                                                      |