pub const FILE_MODE: u32 = 0o600;
The mode of every file the server makes: the service account’s alone, whatever the umask of the process. The umask can only take bits away, and these have none for group or others to lose.