forgejo reactivate

modules/features/mtls/config.nix

@@ -28,6 +28,11 @@
         type = lib.types.str;
         default = "${config.certDir}/mtls.pem";
       };
+      certGroup = lib.mkOption {
+        description = "Group that should be granted read access to generated certificate material.";
+        type = lib.types.str;
+        default = "mtls";
+      };
       subject = lib.mkOption {
         description = "Subject for the cert";
         type = lib.types.str;

modules/features/mtls/mtls-wrappers.nix

@@ -11,7 +11,11 @@ in
         binName = "mtls-generate";
         package = config.pkgs.step-cli;
         extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
-        preHook = "mkdir -p ${config.certDir}";
+        preHook = ''
+          mkdir -p "${config.certDir}"
+          chgrp "${config.certGroup}" "${config.certDir}"
+          chmod 0750 "${config.certDir}"
+        '';
         args = [
           "ca" "certificate"
           "${config.subject}" "${config.certFile}" "${config.keyFile}"
@@ -25,7 +29,11 @@ in
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkSANArgs config.SANs;
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
       };
     });
@@ -45,7 +53,11 @@ in
           "${config.certFile}" "${config.keyFile}"
         ];
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
 
         systemd = {