nixos/privacyidea-ldap-proxy: umask to avoid accidental world-readability
This commit is contained in:
parent
39c0694709
commit
81add6600c
|
@ -332,6 +332,7 @@ in
|
|||
[ cfg.ldap-proxy.environmentFile ];
|
||||
ExecStartPre =
|
||||
"${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
|
||||
umask 0077
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-i ${ldapProxyConfig} \
|
||||
-o $STATE_DIRECTORY/ldap-proxy.ini
|
||||
|
|
Loading…
Reference in a new issue