From cea7eb35ac29b39dd631197a9374453376eecbf0 Mon Sep 17 00:00:00 2001
From: nicknase27 <nick@nicknase27.com>
Date: Sat, 25 Jul 2026 23:54:51 +0200
Subject: [PATCH] proper permissions for secrets

---
 modules/services/caddy.nix       | 2 ++
 modules/services/gitea.nix       | 3 ++-
 modules/services/navidrome.nix   | 2 ++
 modules/services/vaultwarden.nix | 2 ++
 4 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/modules/services/caddy.nix b/modules/services/caddy.nix
index e017025..df5cafa 100644
--- a/modules/services/caddy.nix
+++ b/modules/services/caddy.nix
@@ -81,5 +81,7 @@
   age.secrets.caddy = {
     file = ../../secrets/caddy.age;
     path = "/run/secrets/caddy.env";
+    owner = "caddy";
+    group = "caddy";
   };
 }
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index 1cd4359..0b74a3e 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -24,6 +24,7 @@
   age.secrets.gitea-db = {
     file = ../../secrets/gitea-db.age;
     path = "/run/secrets/gitea-db";
-    mode = "777";
+    owner = "gitea";
+    group = "gitea";
   };
 }
diff --git a/modules/services/navidrome.nix b/modules/services/navidrome.nix
index 3f82afa..472375b 100644
--- a/modules/services/navidrome.nix
+++ b/modules/services/navidrome.nix
@@ -45,6 +45,8 @@
   age.secrets.navidrome = {
     file = ../../secrets/navidrome.age;
     path = "/run/secrets/navidrome.env";
+    owner = "navidrome";
+    group = "navidrome";
   };
 
   systemd.services = {
diff --git a/modules/services/vaultwarden.nix b/modules/services/vaultwarden.nix
index 4266949..21933eb 100644
--- a/modules/services/vaultwarden.nix
+++ b/modules/services/vaultwarden.nix
@@ -21,5 +21,7 @@
   age.secrets.vaultwarden = {
     file = ../../secrets/vaultwarden.age;
     path = "/run/secrets/vaultwarden.env";
+    owner = "vaultwarden";
+    group = "vaultwarden";
   };
 }