feat(hetzner): give stalwart read access to certain keys

2026-08-17 05:26:39 +02:00
parent 38bd5b63f5
commit 75be43140f
2 changed files with 10 additions and 1 deletions
@@ -33,6 +33,10 @@
    #    users.
    install -D -m 0644 "$SRC_CERT" "$DST_CERT"
    install -D -m 0640 "$SRC_KEY"  "$DST_KEY"
+    # Stalwart reads the key as user "stalwart" via %{file:...}%; regrant the
+    # group immediately so every sync leaves it readable (0640 root:stalwart)
+    # and webadmin config reload never fails with EACCES.
+    chgrp stalwart "$DST_KEY"

    # 2) TLSA 3 1 1 = SHA-256 of the certificate's SubjectPublicKeyInfo (SPKI),
    #    NOT the whole certificate. Matching type 1 = SHA-256 of the SPKI DER.