home/xdg: set dir modes via tmpfiles

home/config/xdg/default.nix

@@ -1,9 +1,14 @@
 { config, lib, ... }:
+let
+  cfg = config.xdg.userDirs;
+
+in
 {
   imports = [
     ./mimetypes.nix
     ./directory-spec-overrides.nix
   ];
+
   xdg = {
     enable = true;
     userDirs = {
@@ -18,4 +23,22 @@
       videos = lib.mkDefault "${config.home.homeDirectory}/videos";
     };
   };
+
+  systemd.user.tmpfiles.settings."05-xdg-userdirs" = let
+    dirCfg = {
+      d = {
+        user = config.home.username;
+        mode = "0700";
+      };
+    };
+  in {
+    "${cfg.desktop}" = dirCfg;
+    "${cfg.documents}" = dirCfg;
+    "${cfg.download}" = dirCfg;
+    "${cfg.music}" = dirCfg;
+    "${cfg.pictures}" = dirCfg;
+    "${cfg.publicShare}" = dirCfg;
+    "${cfg.templates}" = dirCfg;
+    "${cfg.videos}" = dirCfg;
+  };
 }