From b44c2a5758c3214a60fbee0299cb6ced0bd7a990 Mon Sep 17 00:00:00 2001 From: squat Date: Mon, 24 Nov 2025 19:16:18 +0100 Subject: [PATCH] nixos/atuin: add environmentFile option for secrets Atuin can be configured to talk to non-local databases, meaning that the database URI may be required to contain secrets, such as a Postgres password. To better support this use-case without leaking secrets, this commit introduces a new option to source environment variables from an environment file. Signed-off-by: squat --- nixos/doc/manual/release-notes/rl-2605.section.md | 1 + nixos/modules/services/misc/atuin.nix | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 7e7274883e06..f15e7f4e7fc6 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -232,6 +232,7 @@ See . - `systemd.sleep.extraConfig` was replaced by [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant `systemd.sleep.settings.Sleep`, which is used to generate the `sleep.conf` configuration file. See {manpage}`sleep.conf.d(5)` for available options. - Support for Bluetooth audio based on `bluez-alsa` has been added to the `hardware.alsa` module. It can be enabled with the new [enableBluetooth](#opt-hardware.alsa.enableBluetooth) option. +- `services.atuin` now has an `environmentFile` option to safely allow configuring secrets, such as an `ATUIN_DB_URI` containing a Postgres password. - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled. This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix. diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix index df1eaa9c63fa..4a851089cca5 100644 --- a/nixos/modules/services/misc/atuin.nix +++ b/nixos/modules/services/misc/atuin.nix @@ -68,6 +68,15 @@ in ''; }; }; + + environmentFile = lib.mkOption { + type = lib.types.nullOr lib.types.externalPath; + default = null; + description = '' + Environment file, used to set any secret ATUIN_* environment variables, such as ATUIN_DB_URI containing a password. + See https://docs.atuin.sh/cli/self-hosting/server-setup/#configuration for available environment variables. + ''; + }; }; }; @@ -105,6 +114,7 @@ in serviceConfig = { ExecStart = "${lib.getExe' cfg.package "atuin-server"} start"; + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; RuntimeDirectory = "atuin"; RuntimeDirectoryMode = "0700"; DynamicUser = true;