From b3b2449b855ef4982df4699e76471d873cc44120 Mon Sep 17 00:00:00 2001
From: Leni Aniva <a@leni.sh>
Date: Thu, 5 Mar 2026 00:39:48 -0800
Subject: [PATCH] nixos/openbao: allow unix socket to be optionally accessed by
 others

When OpenBao is placed behind a reverse proxy like nginx, it's
preferable to have OpenBao listen on a Unix Socket instead of TCP/IP.

OpenBao supports this, we just need to relax our sandboxing for this
ever so slightly.

The default effective socket_mode is left untouched. Meaning even with
RuntimeDirectoryMode=0755, other services can't just access OpenBao's
Unix Socket because of its Umask=0077. One needs to explicitly configure
socket_mode, socket_user and socket_group in OpenBao's [unix listener
config] to make use of this.

Additionally, setting User=openbao and Group=openbao allows other
services to make use of SupplementaryGroups=openbao or OpenBao to use
e.g. Postgres peer authentication.

[unix listener config]: https://openbao.org/docs/configuration/listener/unix/

Co-authored-by emilylange <git@emilylange.de>
---
 nixos/modules/services/security/openbao.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/openbao.nix b/nixos/modules/services/security/openbao.nix
index 9d75ffbebcb7..edb4796ac127 100644
--- a/nixos/modules/services/security/openbao.nix
+++ b/nixos/modules/services/security/openbao.nix
@@ -121,15 +121,18 @@ in
         StateDirectory = "openbao";
         StateDirectoryMode = "0700";
         RuntimeDirectory = "openbao";
-        RuntimeDirectoryMode = "0700";
+        RuntimeDirectoryMode = "0755";
+
+        DynamicUser = true;
+        User = "openbao";
+        Group = "openbao";
 
         CapabilityBoundingSet = "";
-        DynamicUser = true;
         LimitCORE = 0;
         LockPersonality = true;
         MemorySwapMax = 0;
         MemoryZSwapMax = 0;
-        PrivateUsers = true;
+        PrivateUsers = "identity";
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -152,6 +155,7 @@ in
           "@system-service"
           "@resources"
           "~@privileged"
+          "@chown"
         ];
         UMask = "0077";
       };