From a7bfb90ea82b360885dec4b9b2370189bd874d7e Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 29 Aug 2022 09:26:31 +0300
Subject: [PATCH] nixos/vaultwarden: protect the default data directory more

Fixes #179415
---
 nixos/modules/services/security/vaultwarden/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 3aa38ed819f6..9351bff448d3 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -196,6 +196,7 @@ ADMIN_TOKEN=...copy-paste a unique generated secret token here...
         ProtectSystem = "strict";
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         StateDirectory = "bitwarden_rs";
+        StateDirectoryMode = "0700";
       };
       wantedBy = [ "multi-user.target" ];
     };