From 57cbe5b63b6100094583da7f163a90051f3cf4a7 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Wed, 7 Oct 2026 18:25:19 +0300
Subject: [PATCH] fix(docker): the database, secret key and settings are
 private to the app user in the container

---
 conf/runit/10_webvirtcloud_init.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/conf/runit/10_webvirtcloud_init.sh b/conf/runit/10_webvirtcloud_init.sh
index 31f9c290..eb101fdc 100755
--- a/conf/runit/10_webvirtcloud_init.sh
+++ b/conf/runit/10_webvirtcloud_init.sh
@@ -46,3 +46,7 @@ echo "* Running database migrations..."
 chown -R www-data:www-data "$DATA_DIR" "/var/www/.ssh"
 chown www-data:www-data "$APP_DIR/webvirtcloud/settings.py" 2>/dev/null || true
 chmod 700 "/var/www/.ssh" 2>/dev/null || true
+# The database holds compute passwords and password hashes; keep it, the
+# secret key and settings private to the app user (as the installer does)
+chmod 700 "$DATA_DIR"
+chmod 600 "$DATA_DIR/db.sqlite3" "$APP_DIR/webvirtcloud/settings.py"