From c09ce8f190ec4da70f9a44b99320960d27eb6140 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Motiejus=20Jak=C5=A1tys?= <motiejus@jakstys.lt>
Date: Mon, 20 Mar 2023 17:08:43 +0200
Subject: [PATCH] /run/matrix-synapse is a tmpfile

---
 configuration.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/configuration.nix b/configuration.nix
index 680401c..5e81350 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -564,7 +564,7 @@ in {
 
     matrix-synapse = {
       preStart = ''
-        mkdir -p /run/matrix-synapse/
+        umask 077
         ln -sf ''${CREDENTIALS_DIRECTORY}/jakstys.lt.signing.key /run/matrix-synapse/jakstys.lt.signing.key
         cat > /run/matrix-synapse/secrets.yaml <<EOF
         registration_shared_secret: "$(cat ''${CREDENTIALS_DIRECTORY}/registration_shared_secret)"
@@ -576,6 +576,9 @@ in {
         "registration_shared_secret:/var/src/secrets/synapse/registration_shared_secret"
         "macaroon_secret_key:/var/src/secrets/synapse/macaroon_secret_key"
       ];
+      tmpfiles.rules = [
+        "d /run/matrix-synapse 0700 matrix-synapse matrix-synapse -"
+      ];
     };
 
     cert-watcher = {