nixos/atuin: add environmentFile option for secrets (#464654)

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -341,6 +341,7 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 - `systemd.sleep.extraConfig` was replaced by [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant `systemd.sleep.settings.Sleep`, which is used to generate the `sleep.conf` configuration file. See {manpage}`sleep.conf.d(5)` for available options.
 
 - Support for Bluetooth audio based on `bluez-alsa` has been added to the `hardware.alsa` module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option.
+- `services.atuin` now has an `environmentFile` option to safely allow configuring secrets, such as an `ATUIN_DB_URI` containing a Postgres password.
 
 - `systemd.network.*` has been updated to support all configuration options from upstream `networkd` version 259.
 

nixos/modules/services/misc/atuin.nix

@@ -68,6 +68,15 @@ in
           '';
         };
       };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.externalPath;
+        default = null;
+        description = ''
+          Environment file, used to set any secret ATUIN_* environment variables, such as ATUIN_DB_URI containing a password.
+          See https://docs.atuin.sh/cli/self-hosting/server-setup/#configuration for available environment variables.
+        '';
+      };
     };
   };
 
@@ -105,6 +114,7 @@ in
 
       serviceConfig = {
         ExecStart = "${lib.getExe' cfg.package "atuin-server"} start";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         RuntimeDirectory = "atuin";
         RuntimeDirectoryMode = "0700";
         DynamicUser = true;