From 4b3786b53f85223a8527e2fd39c7166471efd204 Mon Sep 17 00:00:00 2001 From: Arun Isaac Date: Fri, 5 Jan 2024 15:41:40 +0000 Subject: Set ownership and permissions on secret files. * genenetwork-development.scm (genenetwork-activation): Set ownership and permissions on secret files. * genenetwork-development-deploy.sh: Share /etc/genenetwork/conf instead of merely exposing it. --- genenetwork-development.scm | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'genenetwork-development.scm') diff --git a/genenetwork-development.scm b/genenetwork-development.scm index 59fbf37..5848ae5 100644 --- a/genenetwork-development.scm +++ b/genenetwork-development.scm @@ -680,17 +680,25 @@ described by CONFIG, a object." (define (genenetwork-activation config) (match-record config - (auth-db-path) + (gn2-secrets gn3-secrets auth-db-path) (with-imported-modules '((guix build utils)) #~(begin (use-modules (guix build utils)) + ;; Set ownership of files. (for-each (lambda (file) (chown file (passwd:uid (getpw "genenetwork")) (passwd:gid (getpw "genenetwork")))) - (find-files #$(dirname auth-db-path) - #:directories? #t)))))) + (cons* #$gn2-secrets + #$gn3-secrets + (find-files #$(dirname auth-db-path) + #:directories? #t))) + ;; Prevent other users from reading secret files. + (for-each (lambda (file) + (chmod file #o600)) + (list #$gn2-secrets + #$gn3-secrets)))))) (define genenetwork-service-type (service-type -- cgit v1.2.3