Repository: ory/kratos
Pull request #1326 (2021-05-10 22:28:47)

Fix: Update link to example email template.
## Related issue

<!--
Please link the GitHub issue this pull request resolves in the format of `#1234`. If you discussed this change
with a maintainer, please mention her/him using the `@` syntax (e.g. `@aeneasr`).

If this change neither resolves an existing issue nor has sign-off from one of the maintainers, there is a
chance substantial changes will be requested or that the changes will be rejected.

You can discuss changes with maintainers either in the Github Discusssions in this repository or
join the [Ory Chat](https://www.ory.sh/chat).
-->

## Proposed changes

Update a link to example email template in documentation.
<!--
Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request.
-->

## Checklist

<!--
Put an `x` in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of
them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.
-->

- [ ] I have read the [contributing guidelines](../blob/master/CONTRIBUTING.md).
- [ ] I have read the [security policy](../security/policy).
- [ ] I confirm that this pull request does not address a security
      vulnerability. If this pull request addresses a security. vulnerability, I
      confirm that I got green light (please contact
      [security@ory.sh](mailto:security@ory.sh)) from the maintainers to push
      the changes.
- [ ] I have added tests that prove my fix is effective or that my feature
      works.
- [x] I have added or changed [the documentation](docs/docs).

## Further comments

<!--
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
you did and what alternatives you considered, etc...
-->



Patch:
diff --git a/.schema/version.schema.json b/.schema/version.schema.json
index b1e223616..3fb19c0f0 100644
--- a/.schema/version.schema.json
+++ b/.schema/version.schema.json
@@ -143,6 +143,20 @@
                     "$ref": "https://raw.githubusercontent.com/ory/kratos/v0.6.0-alpha.2/.schema/config.schema.json"
                 }
             ]
+        },
+        {
+            "allOf": [
+                {
+                    "properties": {
+                        "version": {
+                            "const": "v0.6.1-alpha.1"
+                        }
+                    }
+                },
+                {
+                    "$ref": "https://raw.githubusercontent.com/ory/kratos/v0.6.1-alpha.1/.schema/config.schema.json"
+                }
+            ]
         }
     ]
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44abe1a95..4aaacadc2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,33 +4,35 @@
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 **Table of Contents**
 
-- [Unreleased (2021-05-07)](#unreleased-2021-05-07)
+- [Unreleased (2021-05-11)](#unreleased-2021-05-11)
+  - [0.6.1-alpha.1 (2021-05-11)](#061-alpha1-2021-05-11)
+    - [Features](#features)
 - [0.6.0-alpha.2 (2021-05-07)](#060-alpha2-2021-05-07)
     - [Bug Fixes](#bug-fixes)
-    - [Features](#features)
+    - [Features](#features-1)
 - [0.6.0-alpha.1 (2021-05-05)](#060-alpha1-2021-05-05)
     - [Bug Fixes](#bug-fixes-1)
     - [Code Refactoring](#code-refactoring)
     - [Documentation](#documentation)
-    - [Features](#features-1)
+    - [Features](#features-2)
     - [Tests](#tests)
     - [Unclassified](#unclassified)
     - [BREAKING CHANGES](#breaking-changes)
   - [0.5.5-alpha.1 (2020-12-09)](#055-alpha1-2020-12-09)
     - [Bug Fixes](#bug-fixes-2)
     - [Documentation](#documentation-1)
-    - [Features](#features-2)
+    - [Features](#features-3)
     - [Tests](#tests-1)
     - [Unclassified](#unclassified-1)
   - [0.5.4-alpha.1 (2020-11-11)](#054-alpha1-2020-11-11)
     - [Bug Fixes](#bug-fixes-3)
     - [Code Refactoring](#code-refactoring-1)
     - [Documentation](#documentation-2)
-    - [Features](#features-3)
+    - [Features](#features-4)
   - [0.5.3-alpha.1 (2020-10-27)](#053-alpha1-2020-10-27)
     - [Bug Fixes](#bug-fixes-4)
     - [Documentation](#documentation-3)
-    - [Features](#features-4)
+    - [Features](#features-5)
     - [Tests](#tests-2)
   - [0.5.2-alpha.1 (2020-10-22)](#052-alpha1-2020-10-22)
     - [Bug Fixes](#bug-fixes-5)
@@ -39,14 +41,14 @@
   - [0.5.1-alpha.1 (2020-10-20)](#051-alpha1-2020-10-20)
     - [Bug Fixes](#bug-fixes-6)
     - [Documentation](#documentation-5)
-    - [Features](#features-5)
+    - [Features](#features-6)
     - [Tests](#tests-4)
     - [Unclassified](#unclassified-2)
 - [0.5.0-alpha.1 (2020-10-15)](#050-alpha1-2020-10-15)
     - [Bug Fixes](#bug-fixes-7)
     - [Code Refactoring](#code-refactoring-2)
     - [Documentation](#documentation-6)
-    - [Features](#features-6)
+    - [Features](#features-7)
     - [Tests](#tests-5)
     - [Unclassified](#unclassified-3)
     - [BREAKING CHANGES](#breaking-changes-1)
@@ -65,14 +67,14 @@
     - [Bug Fixes](#bug-fixes-13)
     - [Code Refactoring](#code-refactoring-3)
     - [Documentation](#documentation-8)
-    - [Features](#features-7)
+    - [Features](#features-8)
     - [Unclassified](#unclassified-4)
     - [BREAKING CHANGES](#breaking-changes-2)
 - [0.3.0-alpha.1 (2020-05-15)](#030-alpha1-2020-05-15)
     - [Bug Fixes](#bug-fixes-14)
     - [Code Refactoring](#code-refactoring-4)
     - [Documentation](#documentation-9)
-    - [Features](#features-8)
+    - [Features](#features-9)
     - [Unclassified](#unclassified-5)
     - [BREAKING CHANGES](#breaking-changes-3)
   - [0.2.1-alpha.1 (2020-05-05)](#021-alpha1-2020-05-05)
@@ -81,7 +83,7 @@
     - [Bug Fixes](#bug-fixes-15)
     - [Code Refactoring](#code-refactoring-5)
     - [Documentation](#documentation-11)
-    - [Features](#features-9)
+    - [Features](#features-10)
     - [Unclassified](#unclassified-6)
     - [BREAKING CHANGES](#breaking-changes-4)
   - [0.1.1-alpha.1 (2020-02-18)](#011-alpha1-2020-02-18)
@@ -92,17 +94,17 @@
     - [Bug Fixes](#bug-fixes-17)
     - [Code Refactoring](#code-refactoring-7)
     - [Documentation](#documentation-13)
-    - [Features](#features-10)
+    - [Features](#features-11)
 - [0.1.0-alpha.5 (2020-02-06)](#010-alpha5-2020-02-06)
     - [Documentation](#documentation-14)
-    - [Features](#features-11)
+    - [Features](#features-12)
 - [0.1.0-alpha.4 (2020-02-06)](#010-alpha4-2020-02-06)
     - [Documentation](#documentation-15)
 - [0.1.0-alpha.3 (2020-02-06)](#010-alpha3-2020-02-06)
 - [0.1.0-alpha.2 (2020-02-03)](#010-alpha2-2020-02-03)
     - [Bug Fixes](#bug-fixes-18)
     - [Documentation](#documentation-16)
-    - [Features](#features-12)
+    - [Features](#features-13)
     - [Unclassified](#unclassified-7)
 - [0.1.0-alpha.1 (2020-01-31)](#010-alpha1-2020-01-31)
     - [Documentation](#documentation-17)
@@ -140,11 +142,20 @@
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
-# Unreleased (2021-05-07)
+# Unreleased (2021-05-11)
 
 No significant changes have been made for this release.
 
 
+## [0.6.1-alpha.1](https://github.com/ory/kratos/compare/v0.6.0-alpha.2...v0.6.1-alpha.1) (2021-05-11)
+
+
+### Features
+
+* Allow changing password validation API DNS name ([#1009](https://github.com/ory/kratos/issues/1009)) ([ced85e8](https://github.com/ory/kratos/commit/ced85e8091b06d864cc55c9975f8b006f6be1ce4))
+
+
+
 # [0.6.0-alpha.2](https://github.com/ory/kratos/compare/v0.6.0-alpha.1...v0.6.0-alpha.2) (2021-05-07)
 
 
diff --git a/docs/docs/concepts/email-sms.md b/docs/docs/concepts/email-sms.md
index b5a43617b..637a9bb35 100644
--- a/docs/docs/concepts/email-sms.md
+++ b/docs/docs/concepts/email-sms.md
@@ -100,7 +100,7 @@ filling E-mail subject and body.
     invalidating a verification
 
 For example:
-[`/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl`](https://github.com/ory/kratos/blob/master/courier/template/templates/verification/valid/email.body.gotmpl)
+[`https://github.com/ory/kratos/blob/master/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl`](https://github.com/ory/kratos/blob/master/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl)
 
 ```gotmpl title="courier/template/templates/verification/valid/email.body.gotmpl"
 Hi, please verify your account by clicking the following link:
diff --git a/docs/docs/guides/hosting-own-have-i-been-pwned-api.mdx b/docs/docs/guides/hosting-own-have-i-been-pwned-api.mdx
new file mode 100644
index 000000000..917bb4834
--- /dev/null
+++ b/docs/docs/guides/hosting-own-have-i-been-pwned-api.mdx
@@ -0,0 +1,39 @@
+---
+id: hosting-own-have-i-been-pwned-api
+title: Hosting own Have I Been Pwned API
+---
+
+Ory Kratos uses the Have I Been Pwned (HiBP) API, with the k-anonymity flag, to
+check if the password the user registers with has been a part of one of the
+breaches documented by the HiBP project.
+
+In some environments, due to various CISO policies, it might be difficult to
+establish egress connectivity to non-approved hosts. If it happens that your
+Kratos operates in such an environment and it cannot communicate with the HiBP
+API at haveibeenpwned.com, but there is the requirement to check if passwords
+have been leaked, you can host the HiBP API yourself and configure Kratos to use
+your own instance.
+
+To do so, configure Kratos to use your API:
+
+```yaml title="path/to/kratos/config.yml
+selfservice:
+  methods:
+    password:
+      config:
+        haveibeenpwned_host: api.private.host
+```
+
+An example of a minimal self-hosted, k-anonymity enabled HiBP API
+[can be found in this repository](https://github.com/radekg/hibp).
+
+:::note
+
+Ory Kratos `haveibeenpwned_host` setting does not allow configuring the
+respective CA chain at the moment but it **does require a TLS connection**.
+Therefore your private HiBP API must use one of the trusted CAs of the
+underlying operating system.
+
+A solution might be to host the HiBP API using a certificate issued by Let's
+Encrypt certificate or install the private CA certificate in the trusted CA
+certificates of the system on which Kratos is running.
diff --git a/docs/docs/guides/zero-trust-iap-proxy-identity-access-proxy.mdx b/docs/docs/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
index 739ef1263..97d10b06d 100644
--- a/docs/docs/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
+++ b/docs/docs/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
@@ -34,7 +34,7 @@ Clone the Ory Kratos repository and fetch the latest images:
 ```shell script
 git clone https://github.com/ory/kratos.git
 cd kratos
-git checkout v0.6.0-alpha.2
+git checkout v0.6.1-alpha.1
 
 ```
 
diff --git a/docs/docs/install.md b/docs/docs/install.md
index 2d8a4d2e8..6ad6ee057 100644
--- a/docs/docs/install.md
+++ b/docs/docs/install.md
@@ -11,7 +11,7 @@ binaries, Docker images, and support various package managers.
 We recommend using Docker to run Ory Kratos:
 
 ```shell
-$ docker pull oryd/kratos:v0.6.0-alpha.2
+$ docker pull oryd/kratos:v0.6.1-alpha.1
 $ docker run --rm -it oryd/kratos help
 ```
 
@@ -34,7 +34,7 @@ On linux, you can use `bash <(curl ...)` to fetch the latest stable binary
 using:
 
 ```shell
-$ bash <(curl https://raw.githubusercontent.com/ory/kratos/v0.6.0-alpha.2/install.sh) -b . v0.6.0-alpha.2
+$ bash <(curl https://raw.githubusercontent.com/ory/kratos/v0.6.1-alpha.1/install.sh) -b . v0.6.1-alpha.1
 $ ./kratos help
 ```
 
diff --git a/docs/docs/quickstart.mdx b/docs/docs/quickstart.mdx
index 25b183081..455365f38 100644
--- a/docs/docs/quickstart.mdx
+++ b/docs/docs/quickstart.mdx
@@ -127,7 +127,7 @@ Let's clone Ory Kratos and run `docker-compose`:
 ```shell script
 git clone https://github.com/ory/kratos.git
 cd kratos
-git checkout v0.6.0-alpha.2
+git checkout v0.6.1-alpha.1
 
 docker-compose -f quickstart.yml -f quickstart-standalone.yml up --build --force-recreate
 # If you have SELinux, run:
@@ -552,11 +552,11 @@ recovery, head over to the
 #### Configuration
 
 You can find all configuration files used for this quickstart guide in
-[`./contrib/quickstart/kratos`](https://github.com/ory/kratos/tree/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password)
+[`./contrib/quickstart/kratos`](https://github.com/ory/kratos/tree/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password)
 ,
-[`./quickstart.yml`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart.yml),
+[`./quickstart.yml`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart.yml),
 and
-[`./quickstart-standalone.yml`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart-standalone.yml).
+[`./quickstart-standalone.yml`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart-standalone.yml).
 To understand what each of those configuration files does, consult the other
 chapters of this documentation.
 
@@ -564,11 +564,11 @@ chapters of this documentation.
 
 To get a minimal version of Ory Kratos running, you need to set configuration
 values for
-[`identity.default_schema_url`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password/kratos.yml#L75)
+[`identity.default_schema_url`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password/kratos.yml#L75)
 and
-[`DSN`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart.yml#L42).
+[`DSN`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart.yml#L42).
 You should also configure
-[`selfservice.flows.*.ui_url`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password/kratos.yml#L24)
+[`selfservice.flows.*.ui_url`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password/kratos.yml#L24)
 or else Kratos will use fallback URLs.
 
 :::
diff --git a/docs/docs/reference/configuration.md b/docs/docs/reference/configuration.md
index 0ef7e0c6d..68901118b 100644
--- a/docs/docs/reference/configuration.md
+++ b/docs/docs/reference/configuration.md
@@ -871,6 +871,22 @@ selfservice:
       # Define how passwords are validated.
       #
       config:
+        ## Allow Password Breaches ##
+        #
+        # Defines how often a password may have been breached before it is rejected.
+        #
+        # Minimum value: 0
+        #
+        # Maximum value: 100
+        #
+        # Set this value using environment variables on
+        # - Linux/macOS:
+        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        # - Windows Command Line (CMD):
+        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #
+        max_breaches: 0
+
         ## Ignore Lookup Network Errors ##
         #
         # If set to false the password validation fails when the network or the Have I Been Pwnd API is down.
@@ -885,21 +901,19 @@ selfservice:
         #
         ignore_network_errors: false
 
-        ## Allow Password Breaches ##
-        #
-        # Defines how often a password may have been breached before it is rejected.
+        ## Custom haveibeenpwned host ##
         #
-        # Minimum value: 0
+        # Allows changing the default HIBP host to a self hosted version.
         #
-        # Maximum value: 100
+        # Default value: api.pwnedpasswords.com
         #
         # Set this value using environment variables on
         # - Linux/macOS:
-        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_HAVEIBEENPWNED_HOST=<value>
         # - Windows Command Line (CMD):
-        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_HAVEIBEENPWNED_HOST=<value>
         #
-        max_breaches: 0
+        haveibeenpwned_host: ''
 
       ## Enables Username/Email and Password Method ##
       #
diff --git a/docs/versioned_docs/version-v0.6/concepts/email-sms.md b/docs/versioned_docs/version-v0.6/concepts/email-sms.md
index b5a43617b..637a9bb35 100644
--- a/docs/versioned_docs/version-v0.6/concepts/email-sms.md
+++ b/docs/versioned_docs/version-v0.6/concepts/email-sms.md
@@ -100,7 +100,7 @@ filling E-mail subject and body.
     invalidating a verification
 
 For example:
-[`/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl`](https://github.com/ory/kratos/blob/master/courier/template/templates/verification/valid/email.body.gotmpl)
+[`https://github.com/ory/kratos/blob/master/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl`](https://github.com/ory/kratos/blob/master/courier/template/courier/builtin/templates/verification/valid/email.body.gotmpl)
 
 ```gotmpl title="courier/template/templates/verification/valid/email.body.gotmpl"
 Hi, please verify your account by clicking the following link:
diff --git a/docs/versioned_docs/version-v0.6/guides/hosting-own-have-i-been-pwned-api.mdx b/docs/versioned_docs/version-v0.6/guides/hosting-own-have-i-been-pwned-api.mdx
new file mode 100644
index 000000000..917bb4834
--- /dev/null
+++ b/docs/versioned_docs/version-v0.6/guides/hosting-own-have-i-been-pwned-api.mdx
@@ -0,0 +1,39 @@
+---
+id: hosting-own-have-i-been-pwned-api
+title: Hosting own Have I Been Pwned API
+---
+
+Ory Kratos uses the Have I Been Pwned (HiBP) API, with the k-anonymity flag, to
+check if the password the user registers with has been a part of one of the
+breaches documented by the HiBP project.
+
+In some environments, due to various CISO policies, it might be difficult to
+establish egress connectivity to non-approved hosts. If it happens that your
+Kratos operates in such an environment and it cannot communicate with the HiBP
+API at haveibeenpwned.com, but there is the requirement to check if passwords
+have been leaked, you can host the HiBP API yourself and configure Kratos to use
+your own instance.
+
+To do so, configure Kratos to use your API:
+
+```yaml title="path/to/kratos/config.yml
+selfservice:
+  methods:
+    password:
+      config:
+        haveibeenpwned_host: api.private.host
+```
+
+An example of a minimal self-hosted, k-anonymity enabled HiBP API
+[can be found in this repository](https://github.com/radekg/hibp).
+
+:::note
+
+Ory Kratos `haveibeenpwned_host` setting does not allow configuring the
+respective CA chain at the moment but it **does require a TLS connection**.
+Therefore your private HiBP API must use one of the trusted CAs of the
+underlying operating system.
+
+A solution might be to host the HiBP API using a certificate issued by Let's
+Encrypt certificate or install the private CA certificate in the trusted CA
+certificates of the system on which Kratos is running.
diff --git a/docs/versioned_docs/version-v0.6/guides/zero-trust-iap-proxy-identity-access-proxy.mdx b/docs/versioned_docs/version-v0.6/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
index 739ef1263..97d10b06d 100644
--- a/docs/versioned_docs/version-v0.6/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
+++ b/docs/versioned_docs/version-v0.6/guides/zero-trust-iap-proxy-identity-access-proxy.mdx
@@ -34,7 +34,7 @@ Clone the Ory Kratos repository and fetch the latest images:
 ```shell script
 git clone https://github.com/ory/kratos.git
 cd kratos
-git checkout v0.6.0-alpha.2
+git checkout v0.6.1-alpha.1
 
 ```
 
diff --git a/docs/versioned_docs/version-v0.6/install.md b/docs/versioned_docs/version-v0.6/install.md
index 2d8a4d2e8..6ad6ee057 100644
--- a/docs/versioned_docs/version-v0.6/install.md
+++ b/docs/versioned_docs/version-v0.6/install.md
@@ -11,7 +11,7 @@ binaries, Docker images, and support various package managers.
 We recommend using Docker to run Ory Kratos:
 
 ```shell
-$ docker pull oryd/kratos:v0.6.0-alpha.2
+$ docker pull oryd/kratos:v0.6.1-alpha.1
 $ docker run --rm -it oryd/kratos help
 ```
 
@@ -34,7 +34,7 @@ On linux, you can use `bash <(curl ...)` to fetch the latest stable binary
 using:
 
 ```shell
-$ bash <(curl https://raw.githubusercontent.com/ory/kratos/v0.6.0-alpha.2/install.sh) -b . v0.6.0-alpha.2
+$ bash <(curl https://raw.githubusercontent.com/ory/kratos/v0.6.1-alpha.1/install.sh) -b . v0.6.1-alpha.1
 $ ./kratos help
 ```
 
diff --git a/docs/versioned_docs/version-v0.6/quickstart.mdx b/docs/versioned_docs/version-v0.6/quickstart.mdx
index 25b183081..455365f38 100644
--- a/docs/versioned_docs/version-v0.6/quickstart.mdx
+++ b/docs/versioned_docs/version-v0.6/quickstart.mdx
@@ -127,7 +127,7 @@ Let's clone Ory Kratos and run `docker-compose`:
 ```shell script
 git clone https://github.com/ory/kratos.git
 cd kratos
-git checkout v0.6.0-alpha.2
+git checkout v0.6.1-alpha.1
 
 docker-compose -f quickstart.yml -f quickstart-standalone.yml up --build --force-recreate
 # If you have SELinux, run:
@@ -552,11 +552,11 @@ recovery, head over to the
 #### Configuration
 
 You can find all configuration files used for this quickstart guide in
-[`./contrib/quickstart/kratos`](https://github.com/ory/kratos/tree/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password)
+[`./contrib/quickstart/kratos`](https://github.com/ory/kratos/tree/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password)
 ,
-[`./quickstart.yml`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart.yml),
+[`./quickstart.yml`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart.yml),
 and
-[`./quickstart-standalone.yml`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart-standalone.yml).
+[`./quickstart-standalone.yml`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart-standalone.yml).
 To understand what each of those configuration files does, consult the other
 chapters of this documentation.
 
@@ -564,11 +564,11 @@ chapters of this documentation.
 
 To get a minimal version of Ory Kratos running, you need to set configuration
 values for
-[`identity.default_schema_url`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password/kratos.yml#L75)
+[`identity.default_schema_url`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password/kratos.yml#L75)
 and
-[`DSN`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/quickstart.yml#L42).
+[`DSN`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/quickstart.yml#L42).
 You should also configure
-[`selfservice.flows.*.ui_url`](https://github.com/ory/kratos/blob/v0.6.0-alpha.2/contrib/quickstart/kratos/email-password/kratos.yml#L24)
+[`selfservice.flows.*.ui_url`](https://github.com/ory/kratos/blob/v0.6.1-alpha.1/contrib/quickstart/kratos/email-password/kratos.yml#L24)
 or else Kratos will use fallback URLs.
 
 :::
diff --git a/docs/versioned_docs/version-v0.6/reference/configuration.md b/docs/versioned_docs/version-v0.6/reference/configuration.md
index 0ef7e0c6d..68901118b 100644
--- a/docs/versioned_docs/version-v0.6/reference/configuration.md
+++ b/docs/versioned_docs/version-v0.6/reference/configuration.md
@@ -871,6 +871,22 @@ selfservice:
       # Define how passwords are validated.
       #
       config:
+        ## Allow Password Breaches ##
+        #
+        # Defines how often a password may have been breached before it is rejected.
+        #
+        # Minimum value: 0
+        #
+        # Maximum value: 100
+        #
+        # Set this value using environment variables on
+        # - Linux/macOS:
+        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        # - Windows Command Line (CMD):
+        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #
+        max_breaches: 0
+
         ## Ignore Lookup Network Errors ##
         #
         # If set to false the password validation fails when the network or the Have I Been Pwnd API is down.
@@ -885,21 +901,19 @@ selfservice:
         #
         ignore_network_errors: false
 
-        ## Allow Password Breaches ##
-        #
-        # Defines how often a password may have been breached before it is rejected.
+        ## Custom haveibeenpwned host ##
         #
-        # Minimum value: 0
+        # Allows changing the default HIBP host to a self hosted version.
         #
-        # Maximum value: 100
+        # Default value: api.pwnedpasswords.com
         #
         # Set this value using environment variables on
         # - Linux/macOS:
-        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #    $ export SELFSERVICE_METHODS_PASSWORD_CONFIG_HAVEIBEENPWNED_HOST=<value>
         # - Windows Command Line (CMD):
-        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_MAX_BREACHES=<value>
+        #    > set SELFSERVICE_METHODS_PASSWORD_CONFIG_HAVEIBEENPWNED_HOST=<value>
         #
-        max_breaches: 0
+        haveibeenpwned_host: ''
 
       ## Enables Username/Email and Password Method ##
       #
diff --git a/docs/versioned_sidebars/version-v0.6-sidebars.json b/docs/versioned_sidebars/version-v0.6-sidebars.json
index 146262a0c..93a89bc2e 100644
--- a/docs/versioned_sidebars/version-v0.6-sidebars.json
+++ b/docs/versioned_sidebars/version-v0.6-sidebars.json
@@ -1205,6 +1205,11 @@
                       "type": "link",
                       "href": "https://www.ory.sh/hydra/docs/next/cli/hydra-keys-get"
                     },
+                    {
+                      "label": "hydra keys import",
+                      "type": "link",
+                      "href": "https://www.ory.sh/hydra/docs/next/cli/hydra-keys-import"
+                    },
                     {
                       "label": "hydra migrate",
                       "type": "link",
diff --git a/driver/config/.schema/config.schema.json b/driver/config/.schema/config.schema.json
index 006e258a9..359c18ffa 100644
--- a/driver/config/.schema/config.schema.json
+++ b/driver/config/.schema/config.schema.json
@@ -838,6 +838,12 @@
                   "title": "Password Configuration",
                   "description": "Define how passwords are validated.",
                   "properties": {
+                    "haveibeenpwned_host": {
+                      "title": "Custom haveibeenpwned host",
+                      "description": "Allows changing the default HIBP host to a self hosted version.",
+                      "type": "string",
+                      "default": "api.pwnedpasswords.com"
+                    },
                     "max_breaches": {
                       "title": "Allow Password Breaches",
                       "description": "Defines how often a password may have been breached before it is rejected.",
diff --git a/driver/config/config.go b/driver/config/config.go
index 3b8b682b8..615a67a24 100644
--- a/driver/config/config.go
+++ b/driver/config/config.go
@@ -105,6 +105,7 @@ const (
 	ViperKeyHasherArgon2ConfigExpectedDeviation                     = "hashers.argon2.expected_deviation"
 	ViperKeyHasherArgon2ConfigDedicatedMemory                       = "hashers.argon2.dedicated_memory"
 	ViperKeyHasherBcryptCost                                        = "hashers.bcrypt.cost"
+	ViperKeyPasswordHaveIBeenPwnedHost                              = "selfservice.methods.password.config.haveibeenpwned_host"
 	ViperKeyPasswordMaxBreaches                                     = "selfservice.methods.password.config.max_breaches"
 	ViperKeyIgnoreNetworkErrors                                     = "selfservice.methods.password.config.ignore_network_errors"
 	ViperKeyVersion                                                 = "version"
@@ -148,8 +149,9 @@ type (
 		URL string `json:"url"`
 	}
 	PasswordPolicy struct {
-		MaxBreaches         uint `json:"max_breaches"`
-		IgnoreNetworkErrors bool `json:"ignore_network_errors"`
+		HaveIBeenPwnedHost  string `json:"haveibeenpwned_host"`
+		MaxBreaches         uint   `json:"max_breaches"`
+		IgnoreNetworkErrors bool   `json:"ignore_network_errors"`
 	}
 	Schemas []Schema
 	Config  struct {
@@ -825,6 +827,7 @@ func (p *Config) ConfigVersion() string {
 
 func (p *Config) PasswordPolicyConfig() *PasswordPolicy {
 	return &PasswordPolicy{
+		HaveIBeenPwnedHost:  p.p.StringF(ViperKeyPasswordHaveIBeenPwnedHost, "api.pwnedpasswords.com"),
 		MaxBreaches:         uint(p.p.Int(ViperKeyPasswordMaxBreaches)),
 		IgnoreNetworkErrors: p.p.BoolF(ViperKeyIgnoreNetworkErrors, true),
 	}
diff --git a/quickstart-crdb.yml b/quickstart-crdb.yml
index 74c4c1e70..ef6b177b4 100644
--- a/quickstart-crdb.yml
+++ b/quickstart-crdb.yml
@@ -2,12 +2,12 @@ version: '3.7'
 
 services:
   kratos-migrate:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=cockroach://root@cockroachd:26257/defaultdb?sslmode=disable&max_conns=20&max_idle_conns=4
 
   kratos:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=cockroach://root@cockroachd:26257/defaultdb?sslmode=disable&max_conns=20&max_idle_conns=4
 
diff --git a/quickstart-mysql.yml b/quickstart-mysql.yml
index 2d973f7d4..c21ab179d 100644
--- a/quickstart-mysql.yml
+++ b/quickstart-mysql.yml
@@ -2,12 +2,12 @@ version: '3.7'
 
 services:
   kratos-migrate:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=mysql://root:secret@tcp(mysqld:3306)/mysql?max_conns=20&max_idle_conns=4
 
   kratos:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=mysql://root:secret@tcp(mysqld:3306)/mysql?max_conns=20&max_idle_conns=4
 
diff --git a/quickstart-postgres.yml b/quickstart-postgres.yml
index 47ecb4bc9..297f2a809 100644
--- a/quickstart-postgres.yml
+++ b/quickstart-postgres.yml
@@ -2,12 +2,12 @@ version: '3.7'
 
 services:
   kratos-migrate:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=postgres://kratos:secret@postgresd:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
 
   kratos:
-    image: oryd/kratos:v0.6.0-alpha.2
+    image: oryd/kratos:v0.6.1-alpha.1
     environment:
       - DSN=postgres://kratos:secret@postgresd:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
 
diff --git a/quickstart.yml b/quickstart.yml
index 80b27e685..ec979fbde 100644
--- a/quickstart.yml
+++ b/quickstart.yml
@@ -2,7 +2,7 @@ version: '3.7'
 
 services:
   kratos-migrate:
-    image: oryd/kratos:v0.6.0-alpha.2-sqlite
+    image: oryd/kratos:v0.6.1-alpha.1-sqlite
     environment:
       - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
     volumes:
@@ -30,7 +30,7 @@ services:
   kratos:
     depends_on:
       - kratos-migrate
-    image: oryd/kratos:v0.6.0-alpha.2-sqlite
+    image: oryd/kratos:v0.6.1-alpha.1-sqlite
     ports:
       - '4433:4433' # public
       - '4434:4434' # admin
diff --git a/selfservice/strategy/password/validator.go b/selfservice/strategy/password/validator.go
index f2c4fc075..dd7184862 100644
--- a/selfservice/strategy/password/validator.go
+++ b/selfservice/strategy/password/validator.go
@@ -101,9 +101,9 @@ func lcsLength(a, b string) int {
 	return greatestLength
 }
 
-func (s *DefaultPasswordValidator) fetch(hpw []byte) error {
+func (s *DefaultPasswordValidator) fetch(hpw []byte, apiDNSName string) error {
 	prefix := fmt.Sprintf("%X", hpw)[0:5]
-	loc := fmt.Sprintf("https://api.pwnedpasswords.com/range/%s", prefix)
+	loc := fmt.Sprintf("https://%s/range/%s", apiDNSName, prefix)
 	res, err := s.Client.Get(loc)
 	if err != nil {
 		return errors.Wrapf(ErrNetworkFailure, "%s", err)
@@ -167,9 +167,11 @@ func (s *DefaultPasswordValidator) Validate(ctx context.Context, identifier, pas
 	c, ok := s.hashes[b20(hpw)]
 	s.RUnlock()
 
+	passwordPolicyConfig := s.reg.Config(ctx).PasswordPolicyConfig()
+
 	if !ok {
-		err := s.fetch(hpw)
-		if (errors.Is(err, ErrNetworkFailure) || errors.Is(err, ErrUnexpectedStatusCode)) && s.reg.Config(ctx).PasswordPolicyConfig().IgnoreNetworkErrors {
+		err := s.fetch(hpw, passwordPolicyConfig.HaveIBeenPwnedHost)
+		if (errors.Is(err, ErrNetworkFailure) || errors.Is(err, ErrUnexpectedStatusCode)) && passwordPolicyConfig.IgnoreNetworkErrors {
 			return nil
 		} else if err != nil {
 			return err


Test patch:
diff --git a/driver/config/config_test.go b/driver/config/config_test.go
index d64d59e86..18080983b 100644
--- a/driver/config/config_test.go
+++ b/driver/config/config_test.go
@@ -144,7 +144,7 @@ func TestViperProvider(t *testing.T) {
 				config  string
 				enabled bool
 			}{
-				{id: "password", enabled: true, config: `{"ignore_network_errors":true,"max_breaches":0}`},
+				{id: "password", enabled: true, config: `{"haveibeenpwned_host":"api.pwnedpasswords.com","ignore_network_errors":true,"max_breaches":0}`},
 				{id: "oidc", enabled: true, config: `{"providers":[{"client_id":"a","client_secret":"b","id":"github","provider":"github","mapper_url":"http://test.kratos.ory.sh/default-identity.schema.json"}]}`},
 			} {
 				strategy := p.SelfServiceStrategy(tc.id)
diff --git a/selfservice/strategy/password/validator_test.go b/selfservice/strategy/password/validator_test.go
index 8e581a66a..259cb1aaa 100644
--- a/selfservice/strategy/password/validator_test.go
+++ b/selfservice/strategy/password/validator_test.go
@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"io/ioutil"
 	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"testing"
 	"time"
 
@@ -177,6 +179,33 @@ func TestDefaultPasswordValidationStrategy(t *testing.T) {
 	})
 }
 
+func TestChangeHaveIBeenPwnedValidationHost(t *testing.T) {
+	testServer := httptest.NewUnstartedServer(&fakeValidatorAPI{})
+	defer testServer.Close()
+	testServer.StartTLS()
+	testServerURL, _ := url.Parse(testServer.URL)
+	conf, reg := internal.NewFastRegistryWithMocks(t)
+	s := password.NewDefaultPasswordValidatorStrategy(reg)
+	conf.MustSet(config.ViperKeyPasswordHaveIBeenPwnedHost, testServerURL.Host)
+
+	fakeClient := NewFakeHTTPClient()
+	s.Client = httpx.NewResilientClient(httpx.ResilientClientWithClient(&fakeClient.Client), httpx.ResilientClientWithMaxRetry(1), httpx.ResilientClientWithConnectionTimeout(time.Millisecond))
+
+	testServerExpectedCallURL := fmt.Sprintf("https://%s/range/BCBA9", testServerURL.Host)
+
+	t.Run("case=should send request to test server", func(t *testing.T) {
+		conf.MustSet(config.ViperKeyIgnoreNetworkErrors, false)
+		require.Error(t, s.Validate(context.Background(), "mohutdesub", "damrumukuh"))
+		require.Contains(t, fakeClient.RequestedURLs(), testServerExpectedCallURL)
+	})
+}
+
+type fakeValidatorAPI struct{}
+
+func (api *fakeValidatorAPI) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+}
+
 type fakeHttpClient struct {
 	http.Client