Allow per-app allow/deny.

install

@@ -10,6 +10,10 @@ DATA_ROOT="$DOKKU_LIB_ROOT/data/google-auth"
 mkdir -p "$DATA_ROOT/global" "$DATA_ROOT/apps"
 chown -R dokku:dokku "$DATA_ROOT" 2>/dev/null || true
 chmod 700 "$DATA_ROOT"
+# apps/ is bind-mounted into the service container, which runs as an
+# unprivileged uid and must be able to traverse it to read per-app access
+# lists. The 0700 on DATA_ROOT still keeps other host users out.
+chmod 711 "$DATA_ROOT/apps"
 
 if command -v docker >/dev/null 2>&1; then
   echo "-----> Building dokku-google-auth service image (first build can take a few minutes)"
@@ -25,6 +29,7 @@ if command -v docker >/dev/null 2>&1; then
       --restart=unless-stopped \
       -p "127.0.0.1:${port}:2999" \
       --env-file "$DATA_ROOT/service.env" \
+      -v "$DATA_ROOT/apps:/data/apps:ro" \
       dokku-google-auth:latest >/dev/null
   fi
 else