From f0f690eae4d31e7c0b9e499ddfea120ac70505a0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Apr 2026 17:45:45 +0000
Subject: [PATCH] Make custom.nix read-write (644) on all new installs

Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/1606cde2-b484-4570-a64e-649f80384367

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
---
 iso/installer.py               | 1 +
 iso/sovran-install-headless.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/iso/installer.py b/iso/installer.py
index 65c67ec..3388535 100644
--- a/iso/installer.py
+++ b/iso/installer.py
@@ -948,6 +948,7 @@ class InstallerWindow(Adw.ApplicationWindow):
         if proc.returncode != 0:
             raise RuntimeError(f"Failed to write role-state.nix: {proc.stderr}")
         run(["sudo", "cp", "/mnt/etc/nixos/custom.template.nix", "/mnt/etc/nixos/custom.nix"])
+        run(["sudo", "chmod", "644", "/mnt/etc/nixos/custom.nix"])
 
     # ── Step 4: Ready to install ──────────────────────────────────────────
 
diff --git a/iso/sovran-install-headless.sh b/iso/sovran-install-headless.sh
index bf9fc35..b5d4840 100755
--- a/iso/sovran-install-headless.sh
+++ b/iso/sovran-install-headless.sh
@@ -245,6 +245,7 @@ if [[ -n "$DEPLOY_KEY" || -n "$HEADSCALE_SERVER" ]]; then
     } > /mnt/etc/nixos/custom.nix
 else
     cp /mnt/etc/nixos/custom.template.nix /mnt/etc/nixos/custom.nix
+    chmod 644 /mnt/etc/nixos/custom.nix
 fi
 
 # ── Write Headscale auth key if provided ─────────────────────────────────────