nixos/prometheus-mail-exporter: umask to avoid accidental world-readability
This commit is contained in:
parent
590e60d124
commit
92bd77e85e
|
@ -174,7 +174,10 @@ in
|
|||
EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
|
||||
RuntimeDirectory = "prometheus-mail-exporter";
|
||||
ExecStartPre = [
|
||||
"${pkgs.envsubst}/bin/envsubst -i ${configFile} -o \${RUNTIME_DIRECTORY}/mail-exporter.json"
|
||||
"${pkgs.writeShellScript "subst-secrets-mail-exporter" ''
|
||||
umask 0077
|
||||
${pkgs.envsubst}/bin/envsubst -i ${configFile} -o ''${RUNTIME_DIRECTORY}/mail-exporter.json
|
||||
''}"
|
||||
];
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-mail-exporter}/bin/mailexporter \
|
||||
|
|
Loading…
Reference in a new issue