movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/immich: restrict media filesystem permissions (#361627)

Browse source
This commit is contained in:
Robert Schütz 2024-12-11 08:45:12 -08:00 • committed by GitHub
commit d55cc4608d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nixos/modules/services/web-apps/immich.nix
View file

@ -37,6 +37,7 @@ let
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
UMask = "0077";
};
inherit (lib)
types
@ -353,6 +354,21 @@ in
};
};
systemd.tmpfiles.settings = {
immich = {
# Redundant to the `UMask` service config setting on new installs, but installs made in
# early 24.11 created world-readable media storage by default, which is a privacy risk. This
# fixes those installs.
"${cfg.mediaLocation}" = {
e = {
user = cfg.user;
group = cfg.group;
mode = "0700";
};
};
};
};
users.users = mkIf (cfg.user == "immich") {
immich = {
name = "immich";