openclouders · Oct 8, 2026
diff --git a/docs/_static/env-vars/auth-guest.yaml b/docs/_static/env-vars/auth-guest.yaml
@@ -53,7 +53,6 @@ storage:
 token_manager:
   jwt_secret: ""
 jwt:
-  secret: ""
   cookie_name: __Host-oc_guest_session
   ttl: 24h0m0s
 service_account:

diff --git a/docs/_static/env-vars/auth-guest_configvars.md b/docs/_static/env-vars/auth-guest_configvars.md
@@ -30,7 +30,6 @@
 |`OC_HTTP_TLS_KEY`| 1.0.0 |string|`Path/File name for the TLS certificate key (in PEM format) for the server certificate to use for the http services.`|`""`|
 |`AUTH_GUEST_TOKENS_STORAGE_ROOT`| next |string|`The directory where the guest share tokens are stored. If not defined, the root directory derives from $OC_BASE_DATA_PATH/auth-guest.`|`"/var/lib/opencloud/auth-guest"`|
 |`OC_JWT_SECRET`<br/>`AUTH_GUEST_JWT_SECRET`| next |string|`The secret to mint and validate jwt tokens.`|`""`|
-|`AUTH_GUEST_SESSION_JWT_SECRET`| next |string|`The secret used to sign and validate guest session tokens. It must differ from OC_JWT_SECRET.`|`""`|
 |`AUTH_GUEST_JWT_COOKIE_NAME`| next |string|`The name of the session cookie set when a guest token is redeemed.`|`"__Host-oc_guest_session"`|
 |`AUTH_GUEST_JWT_TTL`| next |Duration|`The lifetime of a redeemed guest session token.`|`"24h0m0s"`|
 |`OC_SERVICE_ACCOUNT_ID`<br/>`AUTH_GUEST_SERVICE_ACCOUNT_ID`| next |string|`The ID of the service account the service should use. See the 'auth-service' service description for more details.`|`""`|

diff --git a/docs/_static/env-vars/auth-guest_readme.md b/docs/_static/env-vars/auth-guest_readme.md
@@ -102,10 +102,11 @@ the event consumer, set `AUTH_GUEST_HTTP_DISABLED=true`.
 
 Relevant options:
 
-- `AUTH_GUEST_SESSION_JWT_SECRET` — secret used to sign guest session tokens.
-  It must differ from `OC_JWT_SECRET`.
 - `AUTH_GUEST_JWT_COOKIE_NAME`, `AUTH_GUEST_JWT_TTL` — session cookie name and
   lifetime.
+- Guest session tokens are signed with a key derived from `OC_JWT_SECRET`. There
+  is no separate secret to configure; rotating `OC_JWT_SECRET` invalidates all
+  guest sessions.
 - `AUTH_GUEST_TOKENS_STORAGE_ROOT` — where guest link token records are stored.
 - `AUTH_GUEST_SERVICE_ACCOUNT_ID`, `AUTH_GUEST_SERVICE_ACCOUNT_SECRET` — service
   account used to query the gateway for share metadata.

diff --git a/docs/_static/env-vars/frontend_configvars.md b/docs/_static/env-vars/frontend_configvars.md
@@ -1,5 +1,5 @@
 
-2026-10-07-00-08-40
+2026-10-08-00-08-12
 
 ## Deprecation Notice
 

diff --git a/docs/_static/env-vars/global_configvars.md b/docs/_static/env-vars/global_configvars.md
diff --git a/docs/_static/env-vars/proxy_readme.md b/docs/_static/env-vars/proxy_readme.md
@@ -405,8 +405,8 @@ The following metrics are exposed by the proxy service:
 | `opencloud_proxy_concurrent_service_requests` | • `service`: identifier of the service the request is proxied to | Counts the number of in-flight requests that are being processed at a given time |
 | `opencloud_proxy_routing_failure_count` | | Counts the number of inbound requests that cannot be proxied due to a failure of determining how to route it |
 | `opencloud_proxy_duration_seconds` | • `service`: identifier of the service the request is proxied to | Classic histogram that measures the duration of proxied HTTP requests, per service |
-| `opencloud_proxy_request_total` | • `method`: the HTTP method<br />• `result`: one of `success` (&lt;=299), `client-error` (&lt;= 499), `server-error` (>= 500), depending on the status code in the response of the proxied HTTP request<br />• `services`: identifier of the service the request is proxied to | Counts the number of proxied requests |
-| `opencloud_proxy_request_duration_seconds_bucket` | • `method`: the HTTP method<br />• `result`: one of `success`, `client-error`, `server-error`, depending on the status code in the response of the proxied HTTP request<br />• `services`: identifier of the service the request is proxied to | Native histogram that measures the duration of proxied HTTP requests, per service |
+| `opencloud_proxy_request_total` | • `method`: the HTTP method<br>• `result`: one of `success` (<=299), `client-error` (<= 499), `server-error` (>= 500), depending on the status code in the response of the proxied HTTP request<br>• `services`: identifier of the service the request is proxied to | Counts the number of proxied requests |
+| `opencloud_proxy_request_duration_seconds_bucket` | • `method`: the HTTP method<br>• `result`: one of `success`, `client-error`, `server-error`, depending on the status code in the response of the proxied HTTP request<br>• `services`: identifier of the service the request is proxied to | Native histogram that measures the duration of proxied HTTP requests, per service |
 | `opencloud_proxy_build_info` | • `version`: build version of the proxy | A gauge with a constant value of `1` |
 
 ### Prometheus Configuration
@@ -433,3 +433,5 @@ scrape_configs:
     static_configs:
     - targets: ["opencloud:9205"]
 ```
+
+
diff --git a/docs/_static/env-vars/storage-users_configvars.md b/docs/_static/env-vars/storage-users_configvars.md
@@ -1,5 +1,5 @@
 
-2026-10-07-00-08-40
+2026-10-08-00-08-12
 
 ## Deprecation Notice
 

diff --git a/docs/_static/env-vars/web_configvars.md b/docs/_static/env-vars/web_configvars.md
@@ -1,5 +1,5 @@
 
-2026-10-07-00-08-40
+2026-10-08-00-08-12
 
 ## Deprecation Notice