From 1ec792c5c2fcfba24afdb16c564ac8e2566d7779 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Sat, 22 Nov 2025 22:39:32 +0000
Subject: [PATCH] nixos/nginx-sso: fix '/run' mode

---
 nixos/modules/services/security/nginx-sso.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/security/nginx-sso.nix b/nixos/modules/services/security/nginx-sso.nix
index 437eb0c62796..f6e3b5deef1d 100644
--- a/nixos/modules/services/security/nginx-sso.nix
+++ b/nixos/modules/services/security/nginx-sso.nix
@@ -65,6 +65,7 @@ in
         StateDirectory = "nginx-sso";
         WorkingDirectory = "/var/lib/nginx-sso";
         RuntimeDirectory = "nginx-sso";
+        RuntimeDirectoryMode = "0700"; # Contains secrets
         ExecStart = ''
           ${lib.getExe cfg.package} \
             --config ${configPath} \