In our koji.spec, we install hub.conf and web.conf with default permissions, which works out to 0644 root:root. I.e. world readable.

However, these files can contain secrets, and in fact our example configs include commented examples of sensitive options in both of these files.

In hub.conf:

##  Basic options  ##
DBName = koji
DBUser = koji
#DBHost = db.example.com
#DBPort = 5432
#DBPass = example_password
KojiDir = /mnt/koji

In web.conf:

# This must be changed and uncommented before deployment
# Secret = CHANGE_ME

We should default to encouraging better security. Probably the simplest thing is to change these files to be 0640 root:apache. They should be readable (but not writable) by apache and not world-readable.

Alternately, we could package a separate secrets.conf under conf.d for both services.

We should also improve some docs related to this:

• emphasize the need for stricter permissions next to the sensitive options in our example configs
• include a note about these permissions in the docs
• document the use of conf.d directories