From dcc376a7758042707173a0b2636e83d6172c0674 Mon Sep 17 00:00:00 2001
From: Patrick Mulligan <patjmulligan@protonmail.com>
Date: Sun, 11 Jan 2026 20:06:55 +0100
Subject: [PATCH] Fix lamassu-db-password permissions for postgres user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add explicit 440 permissions to allow postgres group to read the
database password secret, fixing lamassu-postgres-setup service failure.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 modules/lamassu-lnbits.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/lamassu-lnbits.nix b/modules/lamassu-lnbits.nix
index 0c09e66..d2c44c3 100644
--- a/modules/lamassu-lnbits.nix
+++ b/modules/lamassu-lnbits.nix
@@ -194,6 +194,7 @@ in
       lamassu-db-password = {
         user = cfg.user;
         group = "postgres";
+        permissions = "440";  # Allow postgres group to read
       };
     };