From 447b1cf03d3b96e208de704c75eaaacc96ff7d55 Mon Sep 17 00:00:00 2001
From: Konrad Borowski <konrad@borowski.pw>
Date: Mon, 21 Jun 2021 10:16:47 +0200
Subject: [PATCH] nixos/prometheus: allow state access for service only

There is no reason for Prometheus state files to be
world-readable.
---
 nixos/modules/services/monitoring/prometheus/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index e08f23d8eb04..8fe689ef3dbb 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -945,6 +945,7 @@ in {
         RuntimeDirectoryMode = "0700";
         WorkingDirectory = workingDir;
         StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
       };
     };
   };