nixos/postgresqlBackup: set to umask to 0077

* Ensure that the backup file is only readable by the owner
* Add file permission test to tests
This commit is contained in:
Markus Kowalewski 2018-11-06 21:59:29 +01:00
parent 0d30f7b023
commit a0371d4761
No known key found for this signature in database
GPG key ID: D865C8A91D7025EB
2 changed files with 3 additions and 0 deletions

View file

@ -20,6 +20,8 @@ let
'';
script = ''
umask 0077 # ensure backup is only readable by postgres user
if [ -e ${cfg.location}/${db}.sql.gz ]; then
${pkgs.coreutils}/bin/mv ${cfg.location}/${db}.sql.gz ${cfg.location}/${db}.prev.sql.gz
fi

View file

@ -53,6 +53,7 @@ let
# Check backup service
$machine->succeed("systemctl start postgresqlBackup-postgres.service");
$machine->succeed("zcat /var/backup/postgresql/postgres.sql.gz | grep '<test>ok</test>'");
$machine->succeed("stat -c '%a' /var/backup/postgresql/postgres.sql.gz | grep 600");
$machine->shutdown;
'';