immich file perms

services/gitea.nix

@@ -31,7 +31,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.gitea.stateDir} 0755 ${config.services.gitea.user} ${config.services.gitea.group}"
+    "d ${config.services.gitea.stateDir} 0750 ${config.services.gitea.user} ${config.services.gitea.group}"
   ];
 
   services.postgresql = {

services/immich.nix

@@ -17,7 +17,7 @@
   };
 
   systemd.tmpfiles.rules = [
-    "d ${config.services.immich.mediaLocation} 0755 ${config.services.immich.user} ${config.services.immich.group}"
+    "d ${config.services.immich.mediaLocation} 0750 ${config.services.immich.user} ${config.services.immich.group}"
   ];
 
   environment.systemPackages = with pkgs; [

services/jellyfin.nix

@@ -14,6 +14,7 @@
 
   services.jellyfin = rec {
     enable = true;
+
     # used for local streaming
     openFirewall = true;
 
@@ -21,6 +22,11 @@
     cacheDir = dataDir + "_cache";
   };
 
+  systemd.tmpfiles.rules = [
+    "d ${config.services.jellyfin.dataDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+    "d ${config.services.jellyfin.cacheDir} 0750 ${config.services.jellyfin.user} ${config.services.jellyfin.group}"
+  ];
+
   users.users.${config.services.jellyfin.user}.extraGroups = [
     "video"
     "render"

services/minecraft.nix

@@ -114,7 +114,7 @@ in
   };
 
   systemd.tmpfiles.rules = [
-    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0755 minecraft minecraft"
+    "d ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name} 0750 minecraft minecraft"
   ];
 
   users.users.${username}.extraGroups = [

services/qbittorrent.nix

@@ -26,8 +26,11 @@
     enable = true;
     package = pkgs.qbittorrent-nox;
     webuiPort = service_configs.ports.torrent;
+
     serverConfig.LegalNotice.Accepted = true;
-    serverConfig.Preferences.WebUI = {
+
+    serverConfig.Preferences = {
+      WebUI = {
         AlternativeUIEnabled = true;
         RootFolder = "${pkgs.fetchzip {
           url = "https://github.com/VueTorrent/VueTorrent/releases/download/v2.18.0/vuetorrent.zip";
@@ -39,10 +42,11 @@
         AuthSubnetWhitelistEnabled = true;
       };
 
-    serverConfig.Preferences.Downloads = {
+      Downloads = {
         SavePath = service_configs.torrent.SavePath;
         TempPath = service_configs.torrent.TempPath;
       };
+    };
 
     serverConfig.BitTorrent.Session = {
       GlobalUPSpeedLimit = 1000; # 1 MiB/s