Move the cookie-signing secret out of the cachev2.3.0

2 files changed, 2 insertions, 2 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index d003092..2553233 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -90,7 +90,7 @@ local repos_filename = "/etc/cgit-auth/repos"
 -- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
 -- root, because pruning the cache would delete a secret kept inside it and
 -- invalidate every live session. This file should not be world-readable.
-local secret_filename = "/var/cache/cgit/auth-secret"
+local secret_filename = "/var/lib/cgit/auth-secret"
 
 -- How long a login stays valid, in seconds. Default one week.
 local session_seconds = 7 * 24 * 60 * 60
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index faa3bdc..b50b59a 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -96,7 +96,7 @@ local users = {
 -- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
 -- root, because pruning the cache would delete a secret kept inside it and
 -- invalidate every live session. This file should not be world-readable.
-local secret_filename = "/var/cache/cgit/auth-secret"
+local secret_filename = "/var/lib/cgit/auth-secret"
 
 -- How long a login stays valid, in seconds. Default one week.
 local session_seconds = 7 * 24 * 60 * 60