nixos/privacyidea-ldap-proxy: umask to avoid accidental world-readability

2022-07-20 20:29:38 +02:00
parent 39c0694709
commit 81add6600c
1 changed files with 1 additions and 0 deletions
@@ -332,6 +332,7 @@ in
            [ cfg.ldap-proxy.environmentFile ];
          ExecStartPre =
            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
+              umask 0077
              ${pkgs.envsubst}/bin/envsubst \
                -i ${ldapProxyConfig} \
                -o $STATE_DIRECTORY/ldap-proxy.ini