3 files changed, 17 insertions, 2 deletions
diff --git a/custom/cgitrc b/custom/cgitrc
index c1a5b68..1e2dbaa 100644
--- a/custom/cgitrc
+++ b/custom/cgitrc
@@ -301,8 +301,11 @@ trust-scan-config=0
 
 # Filter command invoked to authenticate access, gating repositories behind a
 # login. See custom/extensions/auth-inline.lua and
-# custom/extensions/auth-file.lua. Value is a command. Default is none.
-#auth-filter=lua:/usr/local/lib/cgit/filters/auth-inline.lua
+# custom/extensions/auth-file.lua. make install overwrites the copies it puts
+# in /usr/local/lib/cgit/filters, so edit a copy kept elsewhere, readable only
+# by root and the web server's group, and point this at it. Value is a
+# command. Default is none.
+#auth-filter=lua:/etc/cgit/auth-inline.lua
 
 # Number of items to display in atom feeds. Value is an integer. Default is 10.
 max-atom-items=10
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index ab56ee1..8a3a771 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -6,6 +6,11 @@
 -- access lists in files on disk, which suits a user set that is large or
 -- maintained by something else. The companion auth-inline.lua behaves
 -- identically but carries the same lists inside the script.
+--
+-- make install puts this script in /usr/local/lib/cgit/filters and overwrites
+-- it there on every run. The files it reads are left alone, but any setting
+-- changed below is lost, so edit a copy kept where make install never writes,
+-- such as /etc/cgit/auth-file.lua, and point auth-filter at it.
 
 -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be
 -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e795717..014caa9 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -6,6 +6,13 @@
 -- lists in two tables inside the script, which suits a small fixed set of
 -- users. The companion auth-file.lua behaves identically but reads the same
 -- lists from files on disk.
+--
+-- make install puts this script in /usr/local/lib/cgit/filters and overwrites
+-- it there on every run, which would wipe the lists below and leave every
+-- repository public. Edit a copy kept where make install never writes, such
+-- as /etc/cgit/auth-inline.lua, and point auth-filter at it. The copy holds
+-- password hashes, so make it readable only by root and the web server's
+-- group, for example root:www-data with mode 0640.
 
 -- The script runs on Lua 5.1 through 5.5 and LuaJIT, and the runtime has to be
 -- the same Lua that cgit was built against. On 5.5 it needs luaossl 20260910
-rw-r--r--	custom/cgitrc	7
-rw-r--r--	custom/extensions/auth-file.lua	5
-rw-r--r--	custom/extensions/auth-inline.lua	7