feat(hetzner): give stalwart read access to certain keys

2026-08-17 05:26:39 +02:00
parent 38bd5b63f5
commit 75be43140f
2 changed files with 10 additions and 1 deletions
@@ -262,7 +262,12 @@ in {

  systemd.services.stalwart-cert-perm = {
    description = "Grant stalwart read access to its TLS private key";
-    after = ["tlsa-update.service" "stalwart.service"];
+    # Belt-and-suspenders: tlsa-update already chgrps the key after every sync;
+    # this guarantees the group grant also exists at first boot, before stalwart
+    # starts (previously ordered after stalwart, so a fresh sync could leave a
+    # root:root key and webadmin reload would fail with EACCES).
+    after = ["tlsa-update.service"];
+    before = ["stalwart.service"];
    partOf = ["tlsa-update.service"];
    wantedBy = ["multi-user.target"];
    path = [pkgs.coreutils];