Unix socket (for serving frontend) created with insufficient permissions

What happened?

When using a unix socket to serve the frontend, the socket file is created with 0755 permissions (tested in the latest docker image).
Any reverse proxy will not be able to access the socket using group memberships.

What did you expect to happen?

Socket file to be created with 0660 or 0666 permissions.

How to reproduce it (minimal and precise)

In configuration.yaml:

frontend:
  enabled: true
  host: /run/zigbee2mqtt/zigbee2mqtt.sock

Run zigbee2mqtt and examine the sock file permissions.

Zigbee2MQTT version

2.13.0

Adapter firmware version

EmberZNet Rev 7.4.4

Adapter

SLZB-MR5U

Setup

Server:
Linux offshore 7.0.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 17 20:52:35 UTC 2026 x86_64 GNU/Linux
Ubuntu 26.04 LTS
Docker image:
ghcr.io/koenkk/zigbee2mqtt:latest - b6b50173d575

Device database.db entry

No response

Debug log

No response

Notes

I have tested two fixes, via selectively patching frontend.js in the docker container.

1. node_fs_1.chmodSync(host, 0o660); (after this.server.listen block for unix socket)
2. this.server.listen({ path: host, readableAll: true, writableAll: true }); (for the unix socket block) - this makes a 0666 file

The method 1 fix is here:
https://github.com/inks007/zigbee2mqtt/blob/fix-unix-socket-permissions/lib/extension/frontend.ts

(I'm new to node.js and I don't know how to transpile the ts to test the direct fix)

Start by reading lib/extension/frontend.ts and locate the Unix-socket server.listen path. Reproduce the issue using the frontend.host configuration from the report and inspect the created socket permissions. Done means the socket is created with permissions that allow access through reverse-proxy group membership, while existing frontend serving still works.