diff options
| -rw-r--r-- | config/web-server.nix | 15 | ||||
| -rw-r--r-- | modules/users.nix | 1 |
2 files changed, 10 insertions, 6 deletions
diff --git a/config/web-server.nix b/config/web-server.nix index c07a4fc..b7ee6b7 100644 --- a/config/web-server.nix +++ b/config/web-server.nix @@ -11,12 +11,15 @@ in { networking.firewall.allowedTCPPorts = [ 80 443 ]; - # I'm storing web files in /home. - systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; - systemd.services.nginx.serviceConfig.ReadWritePaths = [ - "/storage/srv/kj.orbekk.com/tmp/hls/" - "/storage/srv/kj.orbekk.com/dav/" - ]; + systemd.services.nginx.serviceConfig = { + # I used to store web files in /home. + # ProtectHome = "read-only"; + ReadWritePaths = [ + "/storage/srv/kj.orbekk.com/tmp/hls/" + "/storage/srv/kj.orbekk.com/dav/" + ]; + UMask = lib.mkForce "0007"; + }; services.nginx = { enable = true; diff --git a/modules/users.nix b/modules/users.nix index c1cfb6c..da92c65 100644 --- a/modules/users.nix +++ b/modules/users.nix @@ -27,6 +27,7 @@ in { "sound" "tty" "hledger" + "nginx" ]; openssh.authorizedKeys.keyFiles = [ ../data/yubikey_rsa.pub ]; }; |