nixos/acme: hack to fix permissions issue

A *good* fix for this problem looks to be a long way off.  But I need
my certificates to not expire until that happens.

Fixes: https://github.com/NixOS/nixpkgs/issues/48845

1 files changed, 5 insertions, 0 deletions

diff --git a/nixpkgs/nixos/modules/security/acme.nix b/nixpkgs/nixos/modules/security/acme.nix
index 39976380e3b4..4bdfd4ffe750 100644
--- a/nixpkgs/nixos/modules/security/acme.nix
+++ b/nixpkgs/nixos/modules/security/acme.nix
@@ -329,6 +329,11 @@ in
                     WorkingDirectory = spath;
                     # Only try loading the credentialsFile if the dns challenge is enabled
                     EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
+                    preStart = if data.allowKeysForGroup then ''
+                      exec find ${spath}/accounts \
+                          -type f \! -perm 640 -exec chmod 640 '{}' \; , \
+                          -type d \! -perm 750 -exec chmod 750 '{}' \;
+                    '' else null;
                     ExecStart = pkgs.writeScript "acme-start" ''
                       #!${pkgs.runtimeShell} -e
                       test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts