Configuration documentation inconsistencies

[RazerM]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

https://www.ory.sh/docs/hydra/reference/configuration

The comment on ttl.refresh_token says it can be set to -1 to never expire but https://www.ory.sh/docs/hydra/guides/client-token-expiration#refresh-token says the maximum age is 6 months. Also in which version was the 6 months maximum introduced, as I don't find it in the change log.

The comment for secrets.system still says "If none is provided, one will be generated." which is no longer true.

Reproducing the bug

N/A

Relevant log output

No response

Relevant configuration

No response

Version

1.10.7

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response

[RazerM]

This test seems to indicate -1 is still infinite

hydra/driver/config/provider_test.go

Lines 392 to 399 in 400b9af

	func TestInfinitRefreshTokenTTL(t *testing.T) {
	ctx := context.Background()
	l := logrusx.New("", "")
	l.Logrus().SetOutput(io.Discard)
	c := MustNew(context.Background(), l, configx.WithValue("ttl.refresh_token", -1))
	assert.Equal(t, -1*time.Nanosecond, c.GetRefreshTokenLifespan(ctx))
	}

[aeneasr]

The comment on ttl.refresh_token says it can be set to -1 to never expire but https://www.ory.sh/docs/hydra/guides/client-token-expiration#refresh-token says the maximum age is 6 months. Also in which version was the 6 months maximum introduced, as I don't find it in the change log.

This limit applies to Ory Network - here we do not allow -1 refresh tokens because it would fill up our database. In self-hosting setting it to -1 is still possible, but it does mean that you won't be able to scale the system beyond 10M users