From 615022c9ac8691b77c53fc29ac681339cdca66e1 Mon Sep 17 00:00:00 2001
From: Pavel Sviderski <me@psviderski.name>
Date: Sat, 29 Mar 2025 15:19:37 +1000
Subject: [PATCH] feat(scale): set file permissions for machine.db database to
 600 (may container secrets as env vars)

---
 internal/machine/db.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/internal/machine/db.go b/internal/machine/db.go
index 055d5a18..24055856 100644
--- a/internal/machine/db.go
+++ b/internal/machine/db.go
@@ -2,6 +2,7 @@ package machine
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/jmoiron/sqlx"
 	_ "modernc.org/sqlite"
@@ -11,6 +12,19 @@ const DBFileName = "machine.db"
 
 // NewDB creates a new connection to machine SQLite database and runs schema migrations if necessary.
 func NewDB(path string) (*sqlx.DB, error) {
+	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
+		if err != nil {
+			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
+		}
+		file.Close()
+	} else {
+		if err = os.Chmod(path, 0600); err != nil {
+			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
+		}
+	}
+
 	// - Write-Ahead Logging (WAL) mode for better read/write performance.
 	// - Busy timeout (5s) to make concurrent writes wait on each other instead of failing immediately.
 	conn := path + "?_pragma=journal_mode=WAL&_pragma=synchronous=NORMAL&_pragma=busy_timeout=5000&_time_format=sqlite"