From 2b96f8db1d5e15ed1237ca61a53d949b5ab0ab2e Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Fri, 28 Aug 2026 10:42:04 +0200
Subject: iwd-ext: restrict network file permissions

---
 share/nixos-modules/iwd-ext.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'share/nixos-modules')

diff --git a/share/nixos-modules/iwd-ext.nix b/share/nixos-modules/iwd-ext.nix
index 483b688..be9e8e2 100644
--- a/share/nixos-modules/iwd-ext.nix
+++ b/share/nixos-modules/iwd-ext.nix
@@ -204,6 +204,7 @@ in
         EnvironmentFile = "${cfg.secretsEnvFile}";
         StateDirectory = "iwd";
         StateDirectoryMode = 0700;
+        Umask = 077;
       };
 
       path = [ pkgs.envsubst ];
@@ -213,9 +214,12 @@ in
         rm -f "$STATE_DIRECTORY/*.{open,psk,8021x}"
 
         for f in ${networkTemplateDir}/var/lib/iwd/*; do
+          NETWORK_PATH="$STATE_DIRECTORY/$(basename "$f")"
           cat "$f" |
             sed -E 's/@@/\x00/g; s/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g; s/\x00/@/g' |
-            envsubst > "$STATE_DIRECTORY/$(basename "$f")"
+            envsubst > "$NETWORK_PATH"
+
+          chmod go-rwx "$NETWORK_PATH"
         done
       '';
     };
-- 
cgit v1.3.1