From 6c9cb7b0e759444e63df92f466ac11c13018b0f8 Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Mon, 17 Aug 2026 14:16:09 +0200
Subject: [PATCH] fix: atrocore-env ownership for atrocore-db-init
 (AZ-NIX-ava.2)

First deploy failed: atrocore-db-init (User=postgres) could not read
/run/agenix/atrocore-env because agenix defaults to root:root:0400.
Follow the pg-cert/pg-key precedent: owner/group postgres, mode 0400.
Podman still reads the env-file and registry token as root (root
bypasses DAC), container pull/run unaffected. Agenix applies
ownership at activation time - no rekey needed. Validated on AZ-PRM-1.
---
 hosts/AZ-PRM-1/secrets.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hosts/AZ-PRM-1/secrets.nix b/hosts/AZ-PRM-1/secrets.nix
index 4966208..833f6d7 100644
--- a/hosts/AZ-PRM-1/secrets.nix
+++ b/hosts/AZ-PRM-1/secrets.nix
@@ -7,6 +7,9 @@ in {
       {
         atrocore-env = {
           file = ../../secrets/atrocore-env.age;
+          owner = "postgres";
+          group = "postgres";
+          mode = "0400";
         };
         atrocore-registry-token = {
           file = ../../secrets/atrocore-registry-token.age;