infra/common/secrets-permissions.nix
2024-05-28 20:03:01 +02:00

22 lines
No EOL
619 B
Nix

# This module enforces permissions on secrets stored on the machines.
{ config, ... }:
{
system.activationScripts."secrets-permissions" = ''
# Default to restrictive permissions on secrets.
# Root can alway read/write/traverse directories no matter the permissions
# set.
chown --recursive root:root /etc/secrets
chmod --recursive 600 /etc/secrets
# Relax permissions on some secrets.
# The top directory must be readable and traversable by thoses who need to
# access secrets.
chmod 755 /etc/secrets
# ... add chowns & chmods to specific users/groups when needed
'';
}