From adf89a1f258951fa7198b84e1bd0916721eb6a65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Sun, 31 May 2026 19:50:43 +0200
Subject: [PATCH] hive-gateway: chown key.pem root:nginx 0640 for pre-start
 nginx -t

nginx-pre-start runs the config test as the nginx user; a 0600
root-owned key fails that check with BIO_new_file Permission denied
even though the master process would later load it as root.
---
 nix/modules/hive-gateway.nix | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 3435049b..eabd3d10 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -441,17 +441,13 @@ in
               ''
                 set -eu
                 mkdir -p ${tlsDir}
-                # 0755 on BOTH the cert dir and its parent so nginx
-                # (master starts as root but workers drop to the nginx
-                # user) can traverse the whole path to read the cert.
-                # The parent `/var/lib/hive-gateway` lands at 0700 by
-                # default (systemd-nspawn StateDirectory / mkdir umask
-                # depending on which service created it first), which
-                # blocks the nginx-user worker from even reaching
-                # `${tlsDir}` and surfaces as a generic "cannot load
-                # certificate" at nginx start. Re-applied every boot
-                # in case a prior run left a tighter mode behind. Key
-                # stays 0600 below.
+                # 0755 on BOTH the cert dir and its parent so the
+                # nginx user can traverse the full path. The parent
+                # `/var/lib/hive-gateway` lands at 0700 by default
+                # (systemd StateDirectory / mkdir umask depending on
+                # which service created it first), which on its own
+                # blocks traversal. Re-applied every boot in case a
+                # prior run left a tighter mode behind.
                 chmod 0755 ${builtins.dirOf tlsDir}
                 chmod 0755 ${tlsDir}
                 # Generate the cert when EITHER the cert or key is
@@ -470,7 +466,15 @@ in
                     -subj "/CN=${subjectCN}" \
                     -addext "subjectAltName=${sanLines}"
                 fi
-                chmod 0600 ${tlsKey}
+                # Key owned by root:nginx, mode 0640 so nginx-pre-start
+                # (which runs `nginx -t` as the nginx user, not root)
+                # can read it. A 0600 root:root key passes the master-
+                # process load (master starts as root) but fails the
+                # pre-start config test with `BIO_new_file() …
+                # Permission denied`, blocking the unit from starting
+                # at all. Cert is world-readable.
+                chown root:nginx ${tlsKey}
+                chmod 0640 ${tlsKey}
                 chmod 0644 ${tlsCert}
               '';
           };