From e21e664067a86ac8c874d697f0b41950552b70b5 Mon Sep 17 00:00:00 2001
From: Antonis Kotronakis <mail@akotro.dev>
Date: Sun, 17 May 2026 17:35:19 +0100
Subject: [PATCH] nixos/tuwunel: added environmentFile option

---
 nixos/modules/services/matrix/tuwunel.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nixos/modules/services/matrix/tuwunel.nix b/nixos/modules/services/matrix/tuwunel.nix
index 6296fd6cb6cf..6a17ac5f726d 100644
--- a/nixos/modules/services/matrix/tuwunel.nix
+++ b/nixos/modules/services/matrix/tuwunel.nix
@@ -62,6 +62,19 @@ in
       };
     };
 
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/matrix-tuwunel.env";
+      description = ''
+        Path to a file containing sensitive environment variables as described in {manpage}`systemd.exec(5).
+
+        Refer to
+        <https://matrix-construct.github.io/tuwunel/configuration.html#environment-variables>
+        for specifying options as environment variables.
+      '';
+    };
+
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = format.type;
@@ -255,6 +268,7 @@ in
         ExecStart = lib.getExe cfg.package;
         Restart = "on-failure";
         RestartSec = 10;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
       };
     };
   };