From 4f6691c9fffa5fb20817b4bbbfeeaed570c59317 Mon Sep 17 00:00:00 2001
From: Benedikt von Blomberg <github@bvb.anonaddy.com>
Date: Fri, 25 Jul 2025 20:27:21 +0200
Subject: [PATCH] nixos/ddclient: added assertions for passwordFile and
 secretsFile

nix fmt
---
 nixos/modules/services/networking/ddclient.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
index 17fa7a2f7f6e..fed65ee8ec16 100644
--- a/nixos/modules/services/networking/ddclient.nix
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -262,6 +262,17 @@ in
       lib.optional (cfg.use != "")
         "Setting `use` is deprecated, ddclient now supports `usev4` and `usev6` for separate IPv4/IPv6 configuration.";
 
+    assertions = [
+      {
+        assertion = !((cfg.passwordFile != null) && (cfg.secretsFile != null));
+        message = "You cannot use both services.ddclient.passwordFile and services.ddclient.secretsFile at the same time.";
+      }
+      {
+        assertion = !(cfg.protocol == "nsupdate") || (cfg.passwordFile == null && cfg.secretsFile == null);
+        message = "You cannot use services.ddclient.passwordFile and or services.ddclient.secretsFile when services.ddclient.protocol is \"nsupdate\".";
+      }
+    ];
+
     systemd.services.ddclient = {
       description = "Dynamic DNS Client";
       wantedBy = [ "multi-user.target" ];