From 4251ae2da59ceffae9c44393ace26497eec396f0 Mon Sep 17 00:00:00 2001
From: aaron <aaron@0x29a.ch>
Date: Sat, 3 Oct 2026 10:55:05 +0200
Subject: [PATCH] feature(boot): restrict access for /boot to root

---
 INSTALLATION.md                          | 2 +-
 hosts/argon/hardware-configuration.nix   | 4 ++--
 hosts/krypton/hardware-configuration.nix | 4 ++--
 hosts/neon/hardware-configuration.nix    | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/INSTALLATION.md b/INSTALLATION.md
index a8f132d..56d205c 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";
diff --git a/hosts/argon/hardware-configuration.nix b/hosts/argon/hardware-configuration.nix
index 69686bf..4518826 100644
--- a/hosts/argon/hardware-configuration.nix
+++ b/hosts/argon/hardware-configuration.nix
@@ -39,8 +39,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/krypton/hardware-configuration.nix b/hosts/krypton/hardware-configuration.nix
index 10b7825..c0cbae7 100644
--- a/hosts/krypton/hardware-configuration.nix
+++ b/hosts/krypton/hardware-configuration.nix
@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };
 
diff --git a/hosts/neon/hardware-configuration.nix b/hosts/neon/hardware-configuration.nix
index e115731..6986b76 100644
--- a/hosts/neon/hardware-configuration.nix
+++ b/hosts/neon/hardware-configuration.nix
@@ -43,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
     ];
   };