# The registry is provisioned before dwh-auth starts.  The SGID directories
# preserve the dwh-auth group for records written by the operator CLI.
d /var/lib/dwh-auth         2750 root dwh-auth - -
d /var/lib/dwh-auth/active  2750 root dwh-auth - -
d /var/lib/dwh-auth/revoked 2750 root dwh-auth - -
# OpenReadOnly requires a pre-existing read-only shared-lock file.
f /var/lib/dwh-auth/.writer.lock 0640 root dwh-auth - -