nixos/acme: Use more secure chmods

Previous settings would make files executable in
the certs directories.
This commit is contained in:
Lucas Savva 2020-10-22 14:04:31 +01:00
parent d2b8b92865
commit 89d134b3fd
No known key found for this signature in database
GPG key ID: F9CE6D3DCDC78F2D

View file

@ -63,7 +63,7 @@ let
script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: ''
for fixpath in /var/lib/acme/${escapeShellArg cert} /var/lib/acme/.lego/${escapeShellArg cert}; do
if [ -d "$fixpath" ]; then
chmod -R 750 "$fixpath"
chmod -R u=rwX,g=rX,o= "$fixpath"
chown -R acme:${data.group} "$fixpath"
fi
done
@ -271,7 +271,7 @@ let
mv domainhash.txt certificates/
chmod 640 certificates/*
chmod -R 700 accounts/*
chmod -R u=rwX,g=,o= accounts/*
# Group might change between runs, re-apply it
chown 'acme:${data.group}' certificates/*