From aa891853124e81a4ea3f474ac9136e39eba16d15 Mon Sep 17 00:00:00 2001
From: prescientmoon <git@moonythm.dev>
Date: Mon, 11 Mar 2024 16:21:53 +0100
Subject: [PATCH] Fix invidious hmac key perms

---
 hosts/nixos/lapetus/services/invidious.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hosts/nixos/lapetus/services/invidious.nix b/hosts/nixos/lapetus/services/invidious.nix
index 415b104..214103b 100644
--- a/hosts/nixos/lapetus/services/invidious.nix
+++ b/hosts/nixos/lapetus/services/invidious.nix
@@ -4,7 +4,11 @@
     ../../common/optional/services/postgres.nix
   ];
 
-  sops.secrets.invidious_hmac_key.sopsFile = ../secrets.yaml;
+  sops.secrets.invidious_hmac_key = {
+    sopsFile = ../secrets.yaml;
+    mode = "0444"; # I don't care about this key that much, as I'm the only user of this instance
+  };
+
   services.nginx.virtualHosts.${config.services.invidious.domain} =
     config.satellite.proxy config.services.invidious.port { };