Move the cookie-signing secret out of the cachev2.3.0

1 file changed, 1 insertion, 1 deletion

diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index faa3bdc..b50b59a 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -96,7 +96,7 @@ local users = {
 -- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
 -- root, because pruning the cache would delete a secret kept inside it and
 -- invalidate every live session. This file should not be world-readable.
-local secret_filename = "/var/cache/cgit/auth-secret"
+local secret_filename = "/var/lib/cgit/auth-secret"
 
 -- How long a login stays valid, in seconds. Default one week.
 local session_seconds = 7 * 24 * 60 * 60