diff options
Diffstat (limited to 'packaging/deb/meshbay-hub/DEBIAN/postinst')
| -rw-r--r-- | packaging/deb/meshbay-hub/DEBIAN/postinst | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/packaging/deb/meshbay-hub/DEBIAN/postinst b/packaging/deb/meshbay-hub/DEBIAN/postinst index 3cf66a9..0484f3b 100644 --- a/packaging/deb/meshbay-hub/DEBIAN/postinst +++ b/packaging/deb/meshbay-hub/DEBIAN/postinst @@ -17,8 +17,15 @@ case "$1" in install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub install -d -o meshbay -g meshbay -m 750 /var/log/meshbay - # Create config directory (files are placed by the admin, not by us) - install -d -m 755 /etc/meshbay + # Create config directory (files are placed by the admin, not by us — + # a shipped hub.toml would be overwritten on upgrade, and a shipped + # secret would be run in production). The example lands in + # /etc/meshbay/hub.toml.example instead. + # 750, not 755: this directory holds the hub's private key and its + # database password. The file modes protect the contents, but a + # world-listable config directory tells anyone with a shell what a + # hub keeps and where. The service reads it by group. + install -d -o root -g meshbay -m 750 /etc/meshbay # Reload systemd if available if [ -d /run/systemd/system ]; then |