Merge pull request #121299 from Ma27/gitea-umask

nixos/gitea: set umask for secret creation

nixos/modules/services/misc/gitea.nix

@@ -477,6 +477,7 @@ in
       in ''
         # copy custom configuration and generate a random secret key if needed
         ${optionalString (cfg.useWizard == false) ''
+          function gitea_setup {
             cp -f ${configFile} ${runConfig}
 
             if [ ! -e ${secretKey} ]; then
@@ -517,7 +518,8 @@ in
                 -e "s,#internaltoken#,$INTERNALTOKEN,g" \
                 -e "s,#mailerpass#,$MAILERPASSWORD,g" \
                 -i ${runConfig}
-          chmod 640 ${runConfig} ${secretKey} ${oauth2JwtSecret} ${lfsJwtSecret} ${internalToken}
+          }
+          (umask 027; gitea_setup)
         ''}
 
         # update all hooks' binary paths