feat(scale): set file permissions for machine.db database to 600 (may container secrets as env vars)

internal/machine/db.go

@@ -2,6 +2,7 @@ package machine
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/jmoiron/sqlx"
 	_ "modernc.org/sqlite"
@@ -11,6 +12,19 @@ const DBFileName = "machine.db"
 
 // NewDB creates a new connection to machine SQLite database and runs schema migrations if necessary.
 func NewDB(path string) (*sqlx.DB, error) {
+	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
+		if err != nil {
+			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
+		}
+		file.Close()
+	} else {
+		if err = os.Chmod(path, 0600); err != nil {
+			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
+		}
+	}
+
 	// - Write-Ahead Logging (WAL) mode for better read/write performance.
 	// - Busy timeout (5s) to make concurrent writes wait on each other instead of failing immediately.
 	conn := path + "?_pragma=journal_mode=WAL&_pragma=synchronous=NORMAL&_pragma=busy_timeout=5000&_time_format=sqlite"