Make sure debug files are 0600

docker/config/debug.tf

@@ -2,4 +2,5 @@ resource "local_file" "config" {
   count           = var.debug ? 1 : 0
   content         = var.value
   filename        = "${path.root}/.debug/docker/${var.stack_name}/configs/${local.file_name}"
+  file_permission = "0600"
 }

products/docker_registry/registry.tf

@@ -60,6 +60,7 @@ module "docker_registry_config" {
 resource "local_file" "docker_registry_config_yml" {
   content         = yamlencode(local.registry_config_yaml)
   filename        = "${path.root}/.debug/docker-registry/config.yml"
+  file_permission = "0600"
 }
 
 # Registry Service

products/nginx/default_page.tf

@@ -8,6 +8,7 @@ resource "docker_config" "default_page" {
 resource "local_file" "default_page" {
   content         = base64decode(docker_config.default_page.data)
   filename        = "${path.root}/.debug/nginx/index.html"
+  file_permission = "0600"
 }
 resource "docker_config" "default_conf" {
   name = "${var.service_name}.default.conf-${substr(sha1(file("${path.module}/default.conf")), 0, 4)}"
@@ -16,4 +17,5 @@ resource "docker_config" "default_conf" {
 resource "local_file" "default_conf" {
   content         = base64decode(docker_config.default_conf.data)
   filename        = "${path.root}/.debug/nginx/default.conf"
+  file_permission = "0600"
 }

products/nginx/site-available/basic-auth.tf

@@ -19,4 +19,5 @@ resource "local_file" "auth" {
   count           = var.basic_auth != null ? 1 : 0
   content         = local.auth
   filename        = "${path.root}/.debug/nginx/${local.filenames.auth}"
+  file_permission = "0600"
 }

products/nginx/site-available/cert.tf

@@ -10,6 +10,7 @@ resource "local_file" "certificate" {
   count           = var.certificate != null ? 1 : 0
   content         = local.cert_public
   filename        = "${path.root}/.debug/nginx/${local.filenames.certificate}"
+  file_permission = "0600"
 }
 resource "docker_config" "certificate_key" {
   count = var.certificate != null ? 1 : 0
@@ -23,4 +24,5 @@ resource "local_file" "certificate_key" {
   count           = var.certificate != null ? 1 : 0
   content         = var.certificate.private_key_pem
   filename        = "${path.root}/.debug/nginx/${local.filenames.certificate_key}"
+  file_permission = "0600"
 }

products/nginx/site-available/config.tf

@@ -74,4 +74,5 @@ resource "docker_config" "nginx_site_available" {
 resource "local_file" "nginx_site_available" {
   filename        = "${path.root}/.debug/nginx/${local.filenames.nginx}"
   content         = local.config
+  file_permission = "0600"
 }