From 03495efb8b153e8c31a1e2708bfd28becd6221a6 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 21 Jun 2026 20:07:54 +0300 Subject: [PATCH] nixos/pocket-id: clarify 'secrets' option It's not immediately obvious that this takes the keys without the `_KEY` suffix, so better document it. --- nixos/modules/services/security/pocket-id.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix index 9396185c2469..547b3df6db54 100644 --- a/nixos/modules/services/security/pocket-id.nix +++ b/nixos/modules/services/security/pocket-id.nix @@ -70,10 +70,13 @@ in ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key"; }; description = '' - Environment variables which are loaded from the contents of the specified file paths. + Credentials which are loaded from the contents of the specified file paths. + This can be used to securely store tokens and secrets outside of the world-readable Nix store. - See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables). + See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables) (all with the `_FILE` suffix). + + Accepts an attrset mapping from the variable name *without its `_FILE` suffix* to the path on disk. Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file. '';