From 1495647636956868daf831eb6d3480b91e943106 Mon Sep 17 00:00:00 2001 From: buray Date: Fri, 10 Apr 2026 13:00:15 +0300 Subject: [PATCH] fix(config): allow HERMES_HOME_MODE env var to override _secure_dir() permissions (#6993) Operators running a web server (nginx, caddy) that needs to traverse ~/.hermes/ can now set HERMES_HOME_MODE=0701 (or any octal mode) instead of having _secure_dir() revert their manual chmod on every gateway restart. Default behavior (0o700) is unchanged. Fixes #6991. Contributed by @ygd58. --- hermes_cli/config.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/hermes_cli/config.py b/hermes_cli/config.py index 3b4eee14e..a54d07562 100644 --- a/hermes_cli/config.py +++ b/hermes_cli/config.py @@ -158,16 +158,27 @@ def get_project_root() -> Path: return Path(__file__).parent.parent.resolve() def _secure_dir(path): - """Set directory to owner-only access (0700). No-op on Windows. + """Set directory to owner-only access (0700 by default). No-op on Windows. Skipped in managed mode — the NixOS module sets group-readable permissions (0750) so interactive users in the hermes group can share state with the gateway service. + + The mode can be overridden via the HERMES_HOME_MODE environment variable + (e.g. HERMES_HOME_MODE=0701) for deployments where a web server (nginx, + caddy, etc.) needs to traverse HERMES_HOME to reach a served subdirectory. + The execute-only bit on a directory permits cd-through without exposing + directory listings. """ if is_managed(): return try: - os.chmod(path, 0o700) + mode_str = os.environ.get("HERMES_HOME_MODE", "").strip() + mode = int(mode_str, 8) if mode_str else 0o700 + except ValueError: + mode = 0o700 + try: + os.chmod(path, mode) except (OSError, NotImplementedError): pass