From 1be5964c8afb17472f49c13c8206add985b8c585 Mon Sep 17 00:00:00 2001
From: Melorise <0d00@0721.hk>
Date: Thu, 30 Jul 2026 11:37:49 +0800
Subject: [PATCH] fix: restore privileged agent runtime semantics

---
 nix/module.nix  | 28 ++++++++++++++++++++++------
 nix/package.nix |  2 +-
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/nix/module.nix b/nix/module.nix
index 3cab7c1..f5adabf 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -93,6 +93,24 @@ EOF
     update_control_value MANAGED_PORT ${lib.escapeShellArg (toString cfg.port)}
     update_control_value MANAGED_ENTRANCE ${lib.escapeShellArg cfg.securityEntrance}
     update_control_value MANAGED_VERSION ${lib.escapeShellArg (cfg.package.version or "unknown")}
+
+    # nPanel 2.0.0-2.0.1 ran the agent with UMask=0077. Application archives
+    # were therefore extracted with root-only database configuration files,
+    # even when the public archive declared mode 0644. Repair only the known
+    # non-secret database server configuration files; never relax .env files,
+    # credentials, private keys, or the rest of the mutable application tree.
+    for app_root in \
+      "$state_dir/1panel/apps" \
+      "$state_dir/1panel/resource/apps"
+    do
+      if [ -d "$app_root" ]; then
+        find "$app_root" -type f \
+          \( -path '*/mysql/*/conf/my.cnf' \
+             -o -path '*/mysql-cluster/*/conf/my.cnf' \
+             -o -path '*/mariadb/*/conf/my.cnf' \) \
+          -exec chmod 0644 {} +
+      fi
+    done
   '';
 
   commonServiceConfig = {
@@ -114,12 +132,10 @@ EOF
 
     Restart = "on-failure";
     RestartSec = "5s";
-    UMask = "0077";
-    PrivateTmp = true;
-    ProtectSystem = "full";
-    ProtectHome = false;
-    PrivateDevices = false;
-    NoNewPrivileges = false;
+    # The upstream agent is a privileged host-management daemon. Its
+    # application ecosystem relies on the conventional service umask so
+    # non-root processes inside containers can read public configuration.
+    UMask = "0022";
   };
 in
 {
diff --git a/nix/package.nix b/nix/package.nix
index 0bcce64..0901984 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "2.0.1";
+  version = "2.0.2";
 
   frontend = buildNpmPackage {
     pname = "npanel-frontend";