Merge pull request #49840 from markuskowa/fix-pgBackup

nixos/postgresqlBackup: set to umask to 0077
NixOS · Nov 14, 2018 · 58c0c25 · 58c0c25
2 parents 2e18ba6 + a0371d4
commit 58c0c25
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix
@@ -20,6 +20,8 @@ let
       '';
 
       script = ''
+        umask 0077 # ensure backup is only readable by postgres user
+
         if [ -e ${cfg.location}/${db}.sql.gz ]; then
           ${pkgs.coreutils}/bin/mv ${cfg.location}/${db}.sql.gz ${cfg.location}/${db}.prev.sql.gz
         fi

diff --git a/nixos/tests/postgresql.nix b/nixos/tests/postgresql.nix
@@ -58,6 +58,7 @@ let
       # Check backup service
       $machine->succeed("systemctl start postgresqlBackup-postgres.service");
       $machine->succeed("zcat /var/backup/postgresql/postgres.sql.gz | grep '<test>ok</test>'");
+      $machine->succeed("stat -c '%a' /var/backup/postgresql/postgres.sql.gz | grep 600");
       $machine->shutdown;
     '';