gogs service: chmod 440 config file
Directory which contains the config file /var/lib/gogs already has mode 700 but users are liable to change these things.
This commit is contained in:
parent
79d52bc26c
commit
cfa1faa37c
@ -178,16 +178,19 @@ in
|
|||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
path = [ pkgs.gogs.bin ];
|
path = [ pkgs.gogs.bin ];
|
||||||
|
|
||||||
preStart = ''
|
preStart = let
|
||||||
|
runConfig = "${cfg.stateDir}/custom/conf/app.ini";
|
||||||
|
in ''
|
||||||
# copy custom configuration and generate a random secret key if needed
|
# copy custom configuration and generate a random secret key if needed
|
||||||
${optionalString (cfg.useWizard == false) ''
|
${optionalString (cfg.useWizard == false) ''
|
||||||
mkdir -p ${cfg.stateDir}/custom/conf
|
mkdir -p ${cfg.stateDir}/custom/conf
|
||||||
cp -f ${configFile} ${cfg.stateDir}/custom/conf/app.ini
|
cp -f ${configFile} ${runConfig}
|
||||||
KEY=$(head -c 16 /dev/urandom | base64)
|
KEY=$(head -c 16 /dev/urandom | base64)
|
||||||
DBPASS=$(head -n1 ${cfg.database.passwordFile})
|
DBPASS=$(head -n1 ${cfg.database.passwordFile})
|
||||||
sed -e "s,#secretkey#,$KEY,g" \
|
sed -e "s,#secretkey#,$KEY,g" \
|
||||||
-e "s,#dbpass#,$DBPASS,g" \
|
-e "s,#dbpass#,$DBPASS,g" \
|
||||||
-i ${cfg.stateDir}/custom/conf/app.ini
|
-i ${runConfig}
|
||||||
|
chmod 440 ${runConfig}
|
||||||
''}
|
''}
|
||||||
|
|
||||||
mkdir -p ${cfg.repositoryRoot}
|
mkdir -p ${cfg.repositoryRoot}
|
||||||
|
Loading…
Reference in New Issue
Block a user