From 3559bc288e142d76d94d329f6efb66abe53b5d0b Mon Sep 17 00:00:00 2001
From: Alexander Kassouni <alex@kassouni.net>
Date: Fri, 25 Sep 2026 23:40:05 -0700
Subject: git dir permissions

---
 git.nix       | 3 ++-
 minecraft.nix | 5 +----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/git.nix b/git.nix
index a63d718..e365540 100644
--- a/git.nix
+++ b/git.nix
@@ -7,7 +7,7 @@ in {
     group = "git";
     home = repoRoot;
     createHome = true;
-    homeMode = "755";
+    homeMode = "750"; 
     shell = "${pkgs.git}/bin/git-shell";
     openssh.authorizedKeys.keys = config.my.gitKeys;
   };
@@ -25,6 +25,7 @@ in {
   services.cgit.${domain} = {
     enable = true;
     scanPath = repoRoot;
+    group = "git"; # so cgit can traverse a non-world-readable repoRoot
     gitHttpBackend.checkExportOkFiles = true;
     settings.strict-export = "git-daemon-export-ok";
   };
diff --git a/minecraft.nix b/minecraft.nix
index d40d80a..97ebf1d 100644
--- a/minecraft.nix
+++ b/minecraft.nix
@@ -1,5 +1,4 @@
 {lib, ...}:{
-  # The Mojang server jar is unfreeRedistributable, so it has to be allowed by name.
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
     "minecraft-server"
   ];
@@ -7,10 +6,9 @@
   services.minecraft-server = {
     enable = true;
     eula = true;
-    openFirewall = true; # Opens the port the server is running on (25565)
+    openFirewall = true; 
     declarative = true;
     whitelist = {
-      # This is a mapping of Minecraft usernames to to the players' UUIDs
       mr_5aturn = "2b811fad-e419-401e-9185-70ab279219b5";
     };
     serverProperties = {
@@ -18,7 +16,6 @@
       difficulty = "normal";
       gamemode = "survival";
       max-players = 5;
-      motd = "NixOS Minecraft server!";
       white-list = true;
     };
     jvmOpts = "-Xms4096M -Xmx4096M";
-- 
cgit v1.3.1