From 76c669558703dd226319bad64bb90aae779ab736 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Tue, 12 Aug 2025 23:38:05 +0200
Subject: [PATCH] Fix webhook-secrets.conf permissions for real

I did not notice in #1508 that the hydra evaluator now crashed because the hydra config is shared between all components, all of them need to be able to read the secret.
---
 doc/manual/src/webhook-migration-guide.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/webhook-migration-guide.md b/doc/manual/src/webhook-migration-guide.md
index 2da216e7..ddce6feb 100644
--- a/doc/manual/src/webhook-migration-guide.md
+++ b/doc/manual/src/webhook-migration-guide.md
@@ -27,8 +27,8 @@ cat > /var/lib/hydra/secrets/webhook-secrets.conf <<EOF
 EOF
 
 # Set secure permissions
-chmod 0600 /var/lib/hydra/secrets/webhook-secrets.conf
-chown hydra-www:hydra /var/lib/hydra/secrets/webhook-secrets.conf
+chmod 0440 /var/lib/hydra/secrets/webhook-secrets.conf
+chown hydra:hydra /var/lib/hydra/secrets/webhook-secrets.conf
 ```
 
 **Important**: Save the generated secrets to configure them in GitHub/Gitea later. You can view them with: