From 7df8162913a908c0c8714a7736ecd2e2aa451467 Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Wed, 16 Nov 2022 00:12:14 +0100
Subject: [PATCH] nix volumes RO

---
 cluster/staging/app/dummy/deploy/dummy-nginx.hcl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cluster/staging/app/dummy/deploy/dummy-nginx.hcl b/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
index cf9ec94..5f3d5f6 100644
--- a/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
+++ b/cluster/staging/app/dummy/deploy/dummy-nginx.hcl
@@ -37,10 +37,12 @@ job "dummy-nginx" {
 
       volume_mount {
         volume      = "nix-store"
+        read_only = true
         destination = "/nix"
       }
       volume_mount {
         volume      = "nix-current-system-bin"
+        read_only = true
         destination = "/run/current-system/sw/bin"
       }