nixos/actual: allow specifying secretus using genJqSecretsReplacementSnippet

nixos/modules/services/web-apps/actual.nix

@@ -2,6 +2,7 @@
   lib,
   pkgs,
   config,
+  utils,
   ...
 }:
 let
@@ -16,7 +17,6 @@ let
     ;
 
   cfg = config.services.actual;
-  configFile = formatType.generate "config.json" cfg.settings;
   dataDir = "/var/lib/actual";
 
   formatType = pkgs.formats.json { };
@@ -34,7 +34,10 @@ in
 
     settings = mkOption {
       default = { };
-      description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";
+      description = ''
+        Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.
+        You can specify secret values in this configuration by setting `somevalue._secret = "/path/to/file"` instead of setting `somevalue` directly.
+      '';
       type = types.submodule {
         freeformType = formatType.type;
 
@@ -68,13 +71,20 @@ in
       description = "Actual server, a local-first personal finance app";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      environment.ACTUAL_CONFIG_PATH = configFile;
+      environment.ACTUAL_CONFIG_PATH = "/run/actual/config.json";
+
+      preStart = ''
+        # Generate config including secret values.
+        ${utils.genJqSecretsReplacementSnippet cfg.settings "/run/actual/config.json"}
+      '';
+
       serviceConfig = {
         ExecStart = getExe cfg.package;
         DynamicUser = true;
         User = "actual";
         Group = "actual";
         StateDirectory = "actual";
+        RuntimeDirectory = "actual";
         WorkingDirectory = dataDir;
         LimitNOFILE = "1048576";
         PrivateTmp = true;