From 1d8f514240cb8982683da9d6bed5af91fe041360 Mon Sep 17 00:00:00 2001
From: Taeer Bar-Yam <taeer.bar-yam@moduscreate.com>
Date: Thu, 5 Sep 2024 12:03:35 -0400
Subject: [PATCH] patch pixelfed to give nginx read permissions

this way we don't need DANGEROUSLY_SET_FILESYSTEM_DRIVER
---
 pixelfed-group-permissions.patch | 18 ++++++++++++++++++
 pixelfed.nix                     |  6 +++++-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 pixelfed-group-permissions.patch

diff --git a/pixelfed-group-permissions.patch b/pixelfed-group-permissions.patch
new file mode 100644
index 0000000..d7dd442
--- /dev/null
+++ b/pixelfed-group-permissions.patch
@@ -0,0 +1,18 @@
+diff --git a/config/filesystems.php b/config/filesystems.php
+index 00254e93..fc1a58f3 100644
+--- a/config/filesystems.php
++++ b/config/filesystems.php
+@@ -49,11 +49,11 @@ return [
+             'permissions' => [
+                 'file' => [
+                     'public' => 0644,
+-                    'private' => 0600,
++                    'private' => 0640,
+                 ],
+                 'dir' => [
+                     'public' => 0755,
+-                    'private' => 0700,
++                    'private' => 0750,
+                 ],
+             ],
+         ],
diff --git a/pixelfed.nix b/pixelfed.nix
index 1448956..9d2281f 100644
--- a/pixelfed.nix
+++ b/pixelfed.nix
@@ -36,7 +36,7 @@ in
 
   # TODO: factor these out so we're only defining e.g. s3.garage.localhost and port 3900 in one place
   services.pixelfed.settings = {
-    DANGEROUSLY_SET_FILESYSTEM_DRIVER = "s3";
+    # DANGEROUSLY_SET_FILESYSTEM_DRIVER = "s3";
     FILESYSTEM_CLOUD = "s3";
     PF_ENABLE_CLOUD = true;
     AWS_ACCESS_KEY_ID = snakeoil_key.id;
@@ -53,4 +53,8 @@ in
   systemd.services.pixelfed-data-setup = {
     after = [ "ensure-garage.service" ];
   };
+
+  services.pixelfed.package = pkgs.pixelfed.overrideAttrs (old: {
+    patches = (old.patches or [ ]) ++ [ ./pixelfed-group-permissions.patch ];
+  });
 }