From d10f7d4c13473e66bb6a987fdf1cde56ec89938e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Sun, 31 May 2026 19:44:16 +0200 Subject: [PATCH] hive-gateway: chmod cert parent dir so nginx worker can traverse Parent /var/lib/hive-gateway came out 0700, blocking the nginx-user worker from reaching the 0755 tls/ subdir and surfacing as a generic cert-load failure at nginx start. --- nix/modules/hive-gateway.nix | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index da924288..3435049b 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -441,10 +441,18 @@ in '' set -eu mkdir -p ${tlsDir} - # 0755 dir so nginx (master starts as root but workers - # drop to the nginx user) can traverse to read the cert - # path. Re-applied every boot in case a prior run left - # a tighter mode behind. Key stays 0600 below. + # 0755 on BOTH the cert dir and its parent so nginx + # (master starts as root but workers drop to the nginx + # user) can traverse the whole path to read the cert. + # The parent `/var/lib/hive-gateway` lands at 0700 by + # default (systemd-nspawn StateDirectory / mkdir umask + # depending on which service created it first), which + # blocks the nginx-user worker from even reaching + # `${tlsDir}` and surfaces as a generic "cannot load + # certificate" at nginx start. Re-applied every boot + # in case a prior run left a tighter mode behind. Key + # stays 0600 below. + chmod 0755 ${builtins.dirOf tlsDir} chmod 0755 ${tlsDir} # Generate the cert when EITHER the cert or key is # missing/empty, OR the cert fails an openssl parse —