From bd155c18aca00cb9a684ca9457bb8b013e6b7f3e Mon Sep 17 00:00:00 2001 From: Ilker Manap Date: Sun, 4 Oct 2026 11:39:49 +0200 Subject: [PATCH] Give the secrets directory its mode when init hands it to root, so the service can still read the store's address Co-Authored-By: Claude Opus 5.5 (1M context) --- internal/cli/serverinit_postgres.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/internal/cli/serverinit_postgres.go b/internal/cli/serverinit_postgres.go index 4351f24..56c7d1a 100644 --- a/internal/cli/serverinit_postgres.go +++ b/internal/cli/serverinit_postgres.go @@ -389,6 +389,15 @@ func (in *serverInit) writeDSN(dsn string) error { if err := in.chown(dir, false); err != nil { return err } + // Root's, and the service's group may enter it. Its mode set too, not + // only on creation: a directory made 0700 for the service user (as + // `server add` made them) and handed to root here was one the service + // could no longer open, and the gateway did not start. + if in.user != "" { + if err := os.Chmod(dir, 0o750); err != nil { + return err + } + } if err := os.WriteFile(in.dsnPath(), []byte(dsn+"\n"), 0o600); err != nil { return err }