From d199ea28a5c9b186796ce253f6bd1690fc6e10e0 Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Fri, 28 Nov 2025 10:26:06 +0100
Subject: [PATCH] nixos/onlyoffice: document securityNonceFile permissions

Easy to make a mistake with when using a secrets management system such
as agenix
---
 nixos/modules/services/web-apps/onlyoffice.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 5ac94c0cefcc..2d0316761ab3 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -30,6 +30,10 @@ in
         ```
         set $secure_link_secret "changeme";
         ```
+
+        This file must be readable both by nginx and by the onlyoffice
+        documentserver. Since nginx is added to the onlyoffice group,
+        you may want to make the file readable to the onlyoffice group.
       '';
     };