1 files changed, 54 insertions, 2 deletions
diff --git a/authelia/setup.md b/authelia/setup.md
index 9faf7a3..c0edf2b 100644
--- a/authelia/setup.md
+++ b/authelia/setup.md
@@ -245,7 +245,59 @@ Log in immediately after restarting to claim the admin account.
 
 ---
 
-## 12. Enable TOTP two-factor auth (optional, later)
+## 12. Managing users
+
+Users are stored in `/var/authelia/config/users_database.yml` (gitignored — never committed).
+
+### Add a user
+
+**1. Generate a password hash:**
+```bash
+docker run --rm authelia/authelia:latest \
+  authelia crypto hash generate argon2 --password 'their-password'
+```
+
+**2. Add the user to the file:**
+```bash
+nano /var/authelia/config/users_database.yml
+```
+
+```yaml
+users:
+  existing_user:
+    # ...
+
+  new_username:                          # login name (also becomes Jenkins username)
+    displayname: Full Name
+    password: '$argon2id$v=19$m=65536,t=3,p=4$...'   # paste hash here — must be single-quoted
+    email: user@swave.lol
+    groups:
+      - users
+```
+
+**3. Reload Authelia** (it watches the file, but you can force it):
+```bash
+docker kill --signal=HUP authelia
+```
+
+No restart needed — the reload is live.
+
+### Change a password
+
+Generate a new hash and replace the `password:` value for that user, then reload.
+
+### Remove a user
+
+Delete the user's block from the YAML file, then reload.
+
+### Notes
+- Username (YAML key) is what appears in Jenkins, Gerrit, and Authelia logs
+- The `$` characters in the hash must be inside single quotes in YAML
+- Groups aren't enforced by current rules but can be used in `access_control` rules later
+
+---
+
+## 13. Enable TOTP two-factor auth (optional, later)
 
 When ready to require 2FA, change `one_factor` to `two_factor` in
 `/var/authelia/config/configuration.yml` for the rules you want to upgrade, then:
@@ -258,7 +310,7 @@ Users will be prompted to enroll their TOTP app on next login.
 
 ---
 
-## 13. Set up SMTP notifier (optional, later)
+## 14. Set up SMTP notifier (optional, later)
 
 The filesystem notifier writes emails to `/var/authelia/data/notification.txt`.
 To send real emails, replace the `notifier` section in `configuration.yml`: