make config files readonly

Author: kiriwalawren

modules/jellyfin/default.nix

@@ -142,10 +142,10 @@ in {
           SuccessExitStatus = "0 143";
 
           ExecStartPre = pkgs.writeShellScript "jellyfin-setup-config" ''
-            ${pkgs.coreutils}/bin/install -m 640 /etc/jellyfin/network.xml.template '${cfg.configDir}/network.xml'
-            ${pkgs.coreutils}/bin/install -m 640 /etc/jellyfin/branding.xml.template '${cfg.configDir}/branding.xml'
-            ${pkgs.coreutils}/bin/install -m 640 /etc/jellyfin/encoding.xml.template '${cfg.configDir}/encoding.xml'
-            ${pkgs.coreutils}/bin/install -m 640 /etc/jellyfin/system.xml.template '${cfg.configDir}/system.xml'
+            ${pkgs.coreutils}/bin/install -m 440 -o root -g ${cfg.group} /etc/jellyfin/network.xml.template '${cfg.configDir}/network.xml'
+            ${pkgs.coreutils}/bin/install -m 440 -o root -g ${cfg.group} /etc/jellyfin/branding.xml.template '${cfg.configDir}/branding.xml'
+            ${pkgs.coreutils}/bin/install -m 440 -o root -g ${cfg.group} /etc/jellyfin/encoding.xml.template '${cfg.configDir}/encoding.xml'
+            ${pkgs.coreutils}/bin/install -m 440 -o root -g ${cfg.group} /etc/jellyfin/system.xml.template '${cfg.configDir}/system.xml'
           '';
 
           ExecStart =