@@ -88,6 +88,13 @@ in
8888 example = "/run/redis/redis.sock";
8989 };
9090
91+ unixSocketPerm = mkOption {
92+ type = types.int;
93+ default = 750;
94+ description = "Change permissions for the socket";
95+ example = 700;
96+ };
97+
9198 logLevel = mkOption {
9299 type = types.str;
93100 default = "notice"; # debug, verbose, notice, warning
@@ -204,7 +211,6 @@ in
204211 '';
205212 example = literalExample ''
206213 {
207− unixsocketperm = "700";
208214 loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
209215 }
210216 '';
@@ -256,7 +262,7 @@ in
256262 slowlog-max-len = cfg.slowLogMaxLen;
257263 }
258264 (mkIf (cfg.bind != null) { bind = cfg.bind; })
259− (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; })
265+ (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; unixsocketperm = "${toString cfg.unixSocketPerm}"; })
260266 (mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${cfg.slaveOf.port}"; })
261267 (mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; })
262268 (mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; })
@@ -277,11 +283,18 @@ in
277283
278284 serviceConfig = {
279285 ExecStart = "${cfg.package}/bin/redis-server /run/redis/redis.conf";
280− RuntimeDirectory = "redis";
281− StateDirectory = "redis";
282286 Type = "notify";
287+ # User and group
283288 User = "redis";
284289 Group = "redis";
290+ # Runtime directory and mode
291+ RuntimeDirectory = "redis";
292+ RuntimeDirectoryMode = "0750";
293+ # State directory and mode
294+ StateDirectory = "redis";
295+ StateDirectoryMode = "0700";
296+ # Access write directories
297+ UMask = "0077";
285298 };
286299 };
287300 };