From 135badcfa2a4ba62810ef4f37e5b9d950c3418db Mon Sep 17 00:00:00 2001
From: David Wronek <david.wronek@mainlining.org>
Date: Wed, 11 Mar 2026 09:58:27 +0100
Subject: [PATCH 1/3] nixos/esphome: add options for setting environment
 variables

This will allow users to easily set secrets and other environment
variables.

Signed-off-by: David Wronek <david.wronek@mainlining.org>
---
 .../services/home-automation/esphome.nix      | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index 7a66b8ec19f2..b308b2ae4eb6 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -79,6 +79,28 @@ in
       type = types.bool;
       description = "Use ping to check online status of devices instead of mDNS";
     };
+
+    environment = mkOption {
+      default = { };
+      type = types.attrsOf types.str;
+      description = ''
+        Extra environment variables to pass to ESPHome. Secrets should be passed
+        using the {option}`services.esphome.environmentFile` option.
+      '';
+      example = {
+        USERNAME = "reimu";
+        PASSWORD = "gensokyo9";
+      };
+    };
+
+    environmentFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+      description = ''
+        Path to an environment file.
+        Use this option for setting the dashboard password.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -94,7 +116,8 @@ in
         # platformio fails to determine the home directory when using DynamicUser
         PLATFORMIO_CORE_DIR = "${stateDir}/.platformio";
       }
-      // lib.optionalAttrs cfg.usePing { ESPHOME_DASHBOARD_USE_PING = "true"; };
+      // lib.optionalAttrs cfg.usePing { ESPHOME_DASHBOARD_USE_PING = "true"; }
+      // cfg.environment;
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/esphome dashboard ${esphomeParams} ${stateDir}";
@@ -107,6 +130,7 @@ in
         Restart = "on-failure";
         RuntimeDirectory = mkIf cfg.enableUnixSocket "esphome";
         RuntimeDirectoryMode = "0750";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
         # Hardening
         CapabilityBoundingSet = "";

From 19df2b0eb2f2bbff61410d0455d7359f85caf712 Mon Sep 17 00:00:00 2001
From: David Wronek <david.wronek@mainlining.org>
Date: Wed, 11 Mar 2026 12:12:21 +0100
Subject: [PATCH 2/3] nixos/esphome: use %S specifier to find state directory
 root

Signed-off-by: David Wronek <david.wronek@mainlining.org>
---
 nixos/modules/services/home-automation/esphome.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index b308b2ae4eb6..589c566174b5 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -17,7 +17,7 @@ let
 
   cfg = config.services.esphome;
 
-  stateDir = "/var/lib/esphome";
+  stateDir = "esphome";
 
   esphomeParams =
     if cfg.enableUnixSocket then
@@ -114,17 +114,17 @@ in
 
       environment = {
         # platformio fails to determine the home directory when using DynamicUser
-        PLATFORMIO_CORE_DIR = "${stateDir}/.platformio";
+        PLATFORMIO_CORE_DIR = "%S/${stateDir}/.platformio";
       }
       // lib.optionalAttrs cfg.usePing { ESPHOME_DASHBOARD_USE_PING = "true"; }
       // cfg.environment;
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/esphome dashboard ${esphomeParams} ${stateDir}";
+        ExecStart = "${cfg.package}/bin/esphome dashboard ${esphomeParams} %S/${stateDir}";
         DynamicUser = true;
         User = "esphome";
         Group = "esphome";
-        WorkingDirectory = stateDir;
+        WorkingDirectory = "%S/${stateDir}";
         StateDirectory = "esphome";
         StateDirectoryMode = "0750";
         Restart = "on-failure";

From d3e15cd7b18da416ea54c999cb6b49f280462adf Mon Sep 17 00:00:00 2001
From: David Wronek <david.wronek@mainlining.org>
Date: Wed, 11 Mar 2026 12:17:39 +0100
Subject: [PATCH 3/3] nixos/esphome: add state directory to ExecPaths= and
 ReadWritePaths=

Fixes the following issue:
```
sh: line 1: /var/lib/esphome/.platformio/packages/toolchain-gccarmnoneeabi/bin/arm-none-eabi-g++: Permission denied
```

Signed-off-by: David Wronek <david.wronek@mainlining.org>
---
 nixos/modules/services/home-automation/esphome.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index 589c566174b5..7dc8de0f531e 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -131,6 +131,8 @@ in
         RuntimeDirectory = mkIf cfg.enableUnixSocket "esphome";
         RuntimeDirectoryMode = "0750";
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecPaths = "%S/${stateDir}";
+        ReadWritePaths = "%S/${stateDir}";
 
         # Hardening
         CapabilityBoundingSet = "";