From 4cdc31b29a4aaebd336fb329b042c8f748b64369 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Thu, 5 Nov 2026 18:45:08 +0300
Subject: [PATCH] fix(docker): the generated secret key file is private from
 its creation

The container wrote data/secret_key and made it 600 afterwards; it is
now written under umask 077, as the installer does.
---
 conf/runit/10_webvirtcloud_init.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/runit/10_webvirtcloud_init.sh b/conf/runit/10_webvirtcloud_init.sh
index 774612f1..6909517f 100755
--- a/conf/runit/10_webvirtcloud_init.sh
+++ b/conf/runit/10_webvirtcloud_init.sh
@@ -15,8 +15,8 @@ fi
 if [ -z "$SECRET_KEY" ]; then
     if [ ! -s "$DATA_DIR/secret_key" ]; then
         echo "* Generating fresh random SECRET_KEY..."
-        "$APP_DIR/venv/bin/python3" -c 'import secrets; print(secrets.token_urlsafe(50))' > "$DATA_DIR/secret_key"
-        chmod 600 "$DATA_DIR/secret_key"
+        # created private: not readable by others before a chmod
+        (umask 077 && "$APP_DIR/venv/bin/python3" -c 'import secrets; print(secrets.token_urlsafe(50))' > "$DATA_DIR/secret_key")
     fi
 fi