fix(#2422): keep NixOS state private

nix/nixosModules.nix

@@ -87,7 +87,7 @@ let
   needsWritableStateDir = cfg.stateDir != defaultStateDir;
   writableServiceDirs = lib.optionals needsWritableStateDir [ cfg.stateDir ];
   tmpfilesRules = lib.optionals needsWritableStateDir [
-    "d ${cfg.stateDir} 2770 ${cfg.user} ${cfg.group} - -"
+    "d ${cfg.stateDir} 0700 ${cfg.user} ${cfg.group} - -"
   ];
 in
 {
@@ -195,6 +195,8 @@ in
           Environment = mappedEnvironment;
           EnvironmentFile = map builtins.toString cfg.environmentFiles;
           ReadWritePaths = map builtins.toString writableServiceDirs;
+          StateDirectoryMode = "0700";
+          UMask = "0077";
         }
         // lib.optionalAttrs (cfg.stateDir == defaultStateDir) {
           StateDirectory = "hermes-webui";

tests/test_nix_flake_module_source.py

@@ -46,6 +46,13 @@ def test_nixos_module_does_not_chown_existing_hermes_home():
     assert "d ${cfg.hermesHome}" not in MODULE_NIX
 
 
+def test_nixos_module_keeps_webui_state_private_by_default_and_custom_path():
+    assert 'StateDirectoryMode = "0700";' in MODULE_NIX
+    assert 'UMask = "0077";' in MODULE_NIX
+    assert '"d ${cfg.stateDir} 0700 ${cfg.user} ${cfg.group} - -"' in MODULE_NIX
+    assert "2770" not in MODULE_NIX
+
+
 def test_nixos_module_only_creates_default_service_identity():
     assert "cfg.group == defaultGroup" in MODULE_NIX
     assert "cfg.user == defaultUser" in MODULE_NIX