nixos/prometheus: allow state access for service only
There is no reason for Prometheus state files to be
world-readable.
commit447b1cf03d3b96e208de704c75eaaacc96ff7d55
authorKonrad Borowski <konrad@borowski.pw>
dateMon 21 Jun 2021, 10:16 (5 years ago)
parent44b5c74
nixos/modules/services/monitoring/prometheus/default.nix+1
@@ -945,6 +945,7 @@ in {
945945 RuntimeDirectoryMode = "0700";
946946 WorkingDirectory = workingDir;
947947 StateDirectory = cfg.stateDir;
948+ StateDirectoryMode = "0700";
948949 };
949950 };
950951 };