From 1a21338f59a37b057ab6644205f3a4ddd55fcfed Mon Sep 17 00:00:00 2001
From: Noa Aarts <noa@voorwaarts.nl>
Date: Wed, 12 Nov 2025 08:35:51 +0100
Subject: [PATCH] make /boot only root readable

---
 hosts/nuos/disk-config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hosts/nuos/disk-config.nix b/hosts/nuos/disk-config.nix
index 1655b84..f44bae8 100644
--- a/hosts/nuos/disk-config.nix
+++ b/hosts/nuos/disk-config.nix
@@ -21,6 +21,7 @@
               type = "filesystem";
               format = "vfat";
               mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
             };
           };
           root = {