From 7965928b520cd5f505d39cddda37e3fc516e9663 Mon Sep 17 00:00:00 2001
From: Andreas Zweili <andreas@zweili.ch>
Date: Mon, 19 Jun 2023 13:26:33 +0200
Subject: [PATCH] Mount the php ini as read-only

---
 modules/services/nextcloud/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/services/nextcloud/default.nix b/modules/services/nextcloud/default.nix
index 6a48762..dbf33ed 100644
--- a/modules/services/nextcloud/default.nix
+++ b/modules/services/nextcloud/default.nix
@@ -70,7 +70,7 @@ in
         environment = nextcloudEnvironment;
         environmentFiles = [ config.age.secrets.nextcloudEnv.path ];
         volumes = [
-          "${inputs.self}/modules/nextcloud/custom-php.ini:/usr/local/etc/php/conf.d/zzz-custom.ini"
+          "${inputs.self}/modules/nextcloud/custom-php.ini:/usr/local/etc/php/conf.d/zzz-custom.ini:ro"
           "/etc/localtime:/etc/localtime:ro"
         ];
         dependsOn = [ "redis" ];