...

1 files changed, 5 insertions, 1 deletions

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 9c56fb93..52955cd2 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -167,7 +167,11 @@ with lib;
 
     systemd.services.postfix = {
       preStart = concatMapStringsSep "\n" (domain: ''
-        cat /var/lib/acme/${domain}/key.pem /var/lib/acme/${domain}/full.pem > /var/lib/acme/${domain}/sni.pem
+        (
+          umask 0037
+          cat /var/lib/acme/${domain}/key.pem /var/lib/acme/${domain}/full.pem > /var/lib/acme/${domain}/sni.pem
+          chown acme:acme /var/lib/acme/${domain}/sni.pem
+        )
       '') ["bouncy.email" "mailin.bouncy.email" "mailsub.bouncy.email" "surtr.yggdrasil.li"];
       
       serviceConfig.LoadCredential = [