nixos/openbao: allow unix socket to be optionally accessed by others

When OpenBao is placed behind a reverse proxy like nginx, it's
preferable to have OpenBao listen on a Unix Socket instead of TCP/IP.

OpenBao supports this, we just need to relax our sandboxing for this
ever so slightly.

The default effective socket_mode is left untouched. Meaning even with
RuntimeDirectoryMode=0755, other services can't just access OpenBao's
Unix Socket because of its Umask=0077. One needs to explicitly configure
socket_mode, socket_user and socket_group in OpenBao's [unix listener
config] to make use of this.

Additionally, setting User=openbao and Group=openbao allows other
services to make use of SupplementaryGroups=openbao or OpenBao to use
e.g. Postgres peer authentication.

[unix listener config]: https://openbao.org/docs/configuration/listener/unix/

Co-authored-by emilylange <git@emilylange.de>

nixos/modules/services/security/openbao.nix

@@ -121,15 +121,18 @@ in
         StateDirectory = "openbao";
         StateDirectoryMode = "0700";
         RuntimeDirectory = "openbao";
-        RuntimeDirectoryMode = "0700";
+        RuntimeDirectoryMode = "0755";
+
+        DynamicUser = true;
+        User = "openbao";
+        Group = "openbao";
 
         CapabilityBoundingSet = "";
-        DynamicUser = true;
         LimitCORE = 0;
         LockPersonality = true;
         MemorySwapMax = 0;
         MemoryZSwapMax = 0;
-        PrivateUsers = true;
+        PrivateUsers = "identity";
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -152,6 +155,7 @@ in
           "@system-service"
           "@resources"
           "~@privileged"
+          "@chown"
         ];
         UMask = "0077";
       };