nixos/immich: restrict media filesystem permissions

immich appears to create this directory with permissions 0755 by
default, which needlessly exposes user data to other processes.

nixos/modules/services/web-apps/immich.nix

@@ -37,6 +37,7 @@ let
     RestrictNamespaces = true;
     RestrictRealtime = true;
     RestrictSUIDSGID = true;
+    UMask = "0027";
   };
   inherit (lib)
     types
@@ -353,6 +354,18 @@ in
       };
     };
 
+    systemd.tmpfiles.settings = {
+      "immich" = {
+        "${cfg.mediaLocation}" = {
+          d = {
+            user = cfg.user;
+            group = cfg.group;
+            mode = "0750";
+          };
+        };
+      };
+    };
+
     users.users = mkIf (cfg.user == "immich") {
       immich = {
         name = "immich";