iwd-ext: restrict network file permissions

1 files changed, 5 insertions, 1 deletions

diff --git a/share/nixos-modules/iwd-ext.nix b/share/nixos-modules/iwd-ext.nix
index 483b688..be9e8e2 100644
--- a/share/nixos-modules/iwd-ext.nix
+++ b/share/nixos-modules/iwd-ext.nix
@@ -204,6 +204,7 @@ in
         EnvironmentFile = "${cfg.secretsEnvFile}";
         StateDirectory = "iwd";
         StateDirectoryMode = 0700;
+        Umask = 077;
       };
 
       path = [ pkgs.envsubst ];
@@ -213,9 +214,12 @@ in
         rm -f "$STATE_DIRECTORY/*.{open,psk,8021x}"
 
         for f in ${networkTemplateDir}/var/lib/iwd/*; do
+          NETWORK_PATH="$STATE_DIRECTORY/$(basename "$f")"
           cat "$f" |
             sed -E 's/@@/\x00/g; s/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g; s/\x00/@/g' |
-            envsubst > "$STATE_DIRECTORY/$(basename "$f")"
+            envsubst > "$NETWORK_PATH"
+
+          chmod go-rwx "$NETWORK_PATH"
         done
       '';
     };