From 771a0ec70440c501dce1f4e511e7da1fc1a527c9 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Wed, 1 Oct 2025 22:24:54 +0200
Subject: [PATCH] nixos/photoprism: add databasePasswordFile option

---
 .../modules/services/web-apps/photoprism.nix  | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/web-apps/photoprism.nix b/nixos/modules/services/web-apps/photoprism.nix
index 0b0cd3383fcd..22087ca6de3f 100644
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@@ -40,6 +40,14 @@ in
       '';
     };
 
+    databasePasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Database password file.
+      '';
+    };
+
     address = lib.mkOption {
       type = lib.types.str;
       default = "localhost";
@@ -114,9 +122,12 @@ in
           cfg.storagePath
         ];
 
-        LoadCredential = lib.optionalString (
-          cfg.passwordFile != null
-        ) "PHOTOPRISM_ADMIN_PASSWORD_FILE:${cfg.passwordFile}";
+        LoadCredential = [
+          (lib.optionalString (cfg.passwordFile != null) "PHOTOPRISM_ADMIN_PASSWORD_FILE=${cfg.passwordFile}")
+          (lib.optionalString (
+            cfg.databasePasswordFile != null
+          ) "PHOTOPRISM_DATABASE_PASSWORD=${cfg.databasePasswordFile}")
+        ];
 
         LockPersonality = true;
         PrivateDevices = true;
@@ -151,6 +162,9 @@ in
         ${lib.optionalString (cfg.passwordFile != null) ''
           export PHOTOPRISM_ADMIN_PASSWORD_FILE=$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD_FILE
         ''}
+        ${lib.optionalString (cfg.databasePasswordFile != null) ''
+          export PHOTOPRISM_DATABASE_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_DATABASE_PASSWORD")
+        ''}
         exec ${cfg.package}/bin/photoprism migrations run -f
       '';
 
@@ -158,6 +172,9 @@ in
         ${lib.optionalString (cfg.passwordFile != null) ''
           export PHOTOPRISM_ADMIN_PASSWORD_FILE=$CREDENTIALS_DIRECTORY/PHOTOPRISM_ADMIN_PASSWORD_FILE
         ''}
+        ${lib.optionalString (cfg.databasePasswordFile != null) ''
+          export PHOTOPRISM_DATABASE_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PHOTOPRISM_DATABASE_PASSWORD")
+        ''}
         exec ${cfg.package}/bin/photoprism start
       '';
     };