From daa4b9e2717d270280e4d5102c7d57352458136b Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sat, 7 Feb 2026 01:44:11 +0900
Subject: [PATCH] bekkalokk/mediawiki: adjust umask

---
 hosts/bekkalokk/services/mediawiki/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hosts/bekkalokk/services/mediawiki/default.nix b/hosts/bekkalokk/services/mediawiki/default.nix
index 5d73088..ec37d89 100644
--- a/hosts/bekkalokk/services/mediawiki/default.nix
+++ b/hosts/bekkalokk/services/mediawiki/default.nix
@@ -275,6 +275,7 @@ in {
     serviceConfig = {
       BindReadOnlyPaths = [ "/run/credentials/mediawiki-init.service/secret-key:/var/lib/mediawiki/secret.key" ];
       LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
+      UMask = lib.mkForce "0007";
     };
   };
 
@@ -283,6 +284,7 @@ in {
     serviceConfig = {
       BindReadOnlyPaths = [ "/run/credentials/phpfpm-mediawiki.service/secret-key:/var/lib/mediawiki/secret.key" ];
       LoadCredential = [ "secret-key:${config.sops.secrets."mediawiki/secret-key".path}" ];
+      UMask = lib.mkForce "0007";
     };
   };
 }