Document SECURITY_TWO_FACTOR and related 2FA config settings

[sankalpsthakur]

Description

• Document SECURITY_TWO_FACTOR in documentation/configuration.rst (Security section)
• Document closely related 2FA settings: enabled methods, always-validate / login validity, rescue mail, TOTP issuer
• Cross-link the existing installation walkthrough and note that SECURITY_TOTP_SECRETS is required when 2FA is on
• Added changelog item in documentation/changelog.rst

Look & Feel

New entries under Security in the configuration docs (same style as SECURITY_TOKEN_* / SECURITY_TOTP_SECRETS):

• SECURITY_TWO_FACTOR
• SECURITY_TWO_FACTOR_ENABLED_METHODS
• SECURITY_TWO_FACTOR_ALWAYS_VALIDATE
• SECURITY_TWO_FACTOR_LOGIN_VALIDITY
• SECURITY_TWO_FACTOR_RESCUE_MAIL
• SECURITY_TOTP_ISSUER

SECURITY_TOTP_SECRETS already had a section; it now notes that it is required when SECURITY_TWO_FACTOR is enabled.

How to test

Docs-only change. Spot-check the rendered Security section of the configuration docs, or:

# if docs deps are available
uv run poe update-docs
# then open documentation/_build/html/configuration.html

Further Improvements

None planned.

Related Items

Fixes #1760

---

Sign-off

• I agree to contribute to the project under Apache 2 License.
• To the best of my knowledge, the proposed patch is not based on code under GPL or other license that is incompatible with FlexMeasures

---

[Flix6x]

Thanks @sankalpsthakur, nice contribution — the new entries slot neatly into the Security section, and the defaults all check out against the code.

A note on the two commits I pushed to your branch earlier today (I see you've since squashed them into yours, which works too):

1. Linked the cross-reference straight to the "Two-factor authentication" section of the installation docs (it needed a label, installation_two_factor), rather than to the top of the page.
2. Trimmed the changelog entry to reference just the PR — the issue linkage is already covered by "Fixes Missing configuration docs for SECURITY_TWO_FACTOR #1760" in the description.

One heads-up for future PRs re. DCO: if you set git config --global format.signOff true (or just habitually use git commit -s), every commit gets the Signed-off-by line from the start, and you won't need to rewrite history to make the DCO check happy. If you do end up with unsigned commits, git rebase --signoff main fixes them all in one go.

While reviewing, we also noticed that SECURITY_TWO_FACTOR wasn't actually read from the environment, despite what the installation docs (and now these config docs) say — that's fixed in #2341, so your docs will be accurate on both counts. I'll merge this once CI is green.

[read-the-docs-community]

Documentation build overview

📚 flexmeasures | 🛠️ Build #33707978 | 📁 Comparing 270e1f4 against latest (d800b8f)

  🔍 Preview build  

4 files changed

± changelog.html
± configuration.html
± api/v3_0.html
± host/installation.html

[Flix6x]

Thanks!