From cb039ceabd7d9b128749a228e6409f6a60009b34 Mon Sep 17 00:00:00 2001
From: niten <niten@fudo.org>
Date: Sun, 30 Jul 2023 09:17:16 -0700
Subject: [PATCH] Make sure dkim has access to key path

---
 lib/fudo/mail/dkim.nix | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/fudo/mail/dkim.nix b/lib/fudo/mail/dkim.nix
index 69a3704..0874c69 100644
--- a/lib/fudo/mail/dkim.nix
+++ b/lib/fudo/mail/dkim.nix
@@ -99,17 +99,19 @@ in {
       };
     };
 
-    systemd.services.opendkim = {
-      preStart = lib.mkForce createAllCerts;
-      serviceConfig = {
-        ExecStart = lib.mkForce
-          "${cfg.dkim.package}/bin/opendkim ${escapeShellArgs args}";
-        PermissionsStartOnly = lib.mkForce false;
+    systemd = {
+      tmpfiles.rules = [
+        "d '${cfg.dkim.key-directory}' - ${config.services.opendkim.user} ${config.services.opendkim.group} - -"
+      ];
+      services.opendkim = {
+        preStart = lib.mkForce createAllCerts;
+        serviceConfig = {
+          ExecStart = lib.mkForce
+            "${cfg.dkim.package}/bin/opendkim ${escapeShellArgs args}";
+          PermissionsStartOnly = lib.mkForce false;
+          ReadWritePaths = [ cfg.dkim.key-directory ];
+        };
       };
     };
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dkim.key-directory}' - ${config.services.opendkim.user} ${config.services.opendkim.group} - -"
-    ];
   };
 }