2 files changed, 12 insertions, 0 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index ab56ee1..8a3a771 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -6,6 +6,11 @@
 -- access lists in files on disk, which suits a user set that is large or
 -- maintained by something else. The companion auth-inline.lua behaves
 -- identically but carries the same lists inside the script.
+--
+-- make install puts this script in /usr/local/lib/cgit/filters and overwrites
+-- it there on every run. The files it reads are left alone, but any setting
+-- changed below is lost, so edit a copy kept where make install never writes,
+-- such as /etc/cgit/auth-file.lua, and point auth-filter at it.
 
 -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be
 -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e795717..014caa9 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -6,6 +6,13 @@
 -- lists in two tables inside the script, which suits a small fixed set of
 -- users. The companion auth-file.lua behaves identically but reads the same
 -- lists from files on disk.
+--
+-- make install puts this script in /usr/local/lib/cgit/filters and overwrites
+-- it there on every run, which would wipe the lists below and leave every
+-- repository public. Edit a copy kept where make install never writes, such
+-- as /etc/cgit/auth-inline.lua, and point auth-filter at it. The copy holds
+-- password hashes, so make it readable only by root and the web server's
+-- group, for example root:www-data with mode 0640.
 
 -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be
 -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910
-rw-r--r--	custom/extensions/auth-file.lua	5
-rw-r--r--	custom/extensions/auth-inline.lua	7