From 4e2c47f4a37eb18c5319bedc74faf0464e6a3c3e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 28 Jun 2023 15:10:43 -0400 Subject: [PATCH] nixos/paperless: Enable UMask now that it works (#240352) According to https://github.com/NixOS/nixpkgs/issues/147599#issuecomment-1272286679 the bug that prevented this UMask directive from working has been fixed in systemd, so it should be safe to use now. This stops paperless-ngx from making everything world-readable on disk, but it does not change permissions of any files previously created. (cherry picked from commit c23f47f23e0104d6e22f0a5df4ef5d3b280e3a49) Co-authored-by: Benjamin Staffin --- nixos/modules/services/misc/paperless.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix index 4199e7713304..afdc19532dce 100644 --- a/nixos/modules/services/misc/paperless.nix +++ b/nixos/modules/services/misc/paperless.nix @@ -86,8 +86,7 @@ let SupplementaryGroups = optional enableRedis redisServer.user; SystemCallArchitectures = "native"; SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ]; - # Does not work well with the temporary root - #UMask = "0066"; + UMask = "0066"; }; in {