Merge ~troyanov/maas:fix-agent-httpproxy-sock-permissions into maas:master

[Anton Troyanov]

fix: set 660 permissions on httpproxy.sock

NGINX workers are running as nobody:maas

[Adam Collard (adam-collard)]

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b fix-agent-httpproxy-sock-permissions lp:~troyanov/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci.internal:8080/job/maas-tester/4721/console
COMMIT: 13b083be39cc6aa005ad1b56597e7f8e64acf37c

review: Needs Fixing

[MAAS Lander (maas-lander)]

UNIT TESTS
-b fix-agent-httpproxy-sock-permissions lp:~troyanov/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: c9015fa2f869517798c3d3975e0a45c71b7fa2c1

review: Approve

diff --git a/debian/extras/nginx.conf b/debian/extras/nginx.conf
index 8c5787d..ab279e2 100644
--- a/debian/extras/nginx.conf
+++ b/debian/extras/nginx.conf
@@ -1,6 +1,8 @@
 pid /run/maas-http.pid;
 worker_processes auto;
 
+user nobody maas;
+
 error_log /var/log/maas/http/error.log;
 
 events {
diff --git a/src/maasagent/internal/httpproxy/service.go b/src/maasagent/internal/httpproxy/service.go
index c9bb1eb..94e4172 100644
--- a/src/maasagent/internal/httpproxy/service.go
+++ b/src/maasagent/internal/httpproxy/service.go
@@ -127,6 +127,11 @@ func (s *HTTPProxyService) Configure(ctx tworkflow.Context, systemID string) err
 		return err
 	}
 
+	//nolint:gosec // we know what we are doing here and we need 0660
+	if err := os.Chmod(s.socketPath, 0660); err != nil {
+		return err
+	}
+
 	// XXX: While httpproxy-service service is consumed through socket via NGINX
 	// there is nothing bad about not setting the timeout on the listener/server/