From 67eb12c0ed95b9cd8f98948d6c9bc7cdbf92660f Mon Sep 17 00:00:00 2001
From: Andrew Morgan <andrew@amorgan.xyz>
Date: Tue, 13 Aug 2024 19:28:03 +0100
Subject: [PATCH 1/2] open-webui: Add `environmentFile` option

This option allows passing secrets to Open WebUI without directly
exposing them in nix configuration.
---
 nixos/modules/services/misc/open-webui.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/services/misc/open-webui.nix b/nixos/modules/services/misc/open-webui.nix
index e2ed7080c922..abe27ccdbcf7 100644
--- a/nixos/modules/services/misc/open-webui.nix
+++ b/nixos/modules/services/misc/open-webui.nix
@@ -60,6 +60,17 @@ in
         '';
       };
 
+      environmentFile = lib.mkOption {
+        description = ''
+          Environment file to be passed to the systemd service.
+          Useful for passing secrets to the service to prevent them from being
+          world-readable in the Nix store.
+        '';
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/var/lib/secrets/openWebuiSecrets";
+      };
+
       openFirewall = lib.mkOption {
         type = types.bool;
         default = false;
@@ -86,6 +97,7 @@ in
 
       serviceConfig = {
         ExecStart = "${lib.getExe cfg.package} serve --host ${cfg.host} --port ${toString cfg.port}";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
         WorkingDirectory = cfg.stateDir;
         StateDirectory = "open-webui";
         RuntimeDirectory = "open-webui";

From 908c5df932dc4ab5aeeb0052e56d53fd81e1a379 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <andrew@amorgan.xyz>
Date: Thu, 15 Aug 2024 12:08:46 +0100
Subject: [PATCH 2/2] open-webui: test `environmentFile` option

Modify the tests for open-webui such that the name of the service
is set via the 'environmentFile' option, then check that the
service's name differs from the default.
---
 nixos/tests/open-webui.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/open-webui.nix b/nixos/tests/open-webui.nix
index f10ef1ad98fb..faf4dae671d0 100644
--- a/nixos/tests/open-webui.nix
+++ b/nixos/tests/open-webui.nix
@@ -1,6 +1,7 @@
-{ lib, ... }:
+{ config, lib, ... }:
 let
   mainPort = "8080";
+  webuiName = "NixOS Test";
 in
 {
   name = "open-webui";
@@ -18,16 +19,31 @@ in
             # Requires network connection
             RAG_EMBEDDING_MODEL = "";
           };
+
+          # Test that environment variables can be
+          # overridden through a file.
+          environmentFile = config.node.pkgs.writeText "test.env" ''
+            WEBUI_NAME="${webuiName}"
+          '';
         };
       };
   };
 
   testScript = ''
+    import json
+
     machine.start()
 
     machine.wait_for_unit("open-webui.service")
     machine.wait_for_open_port(${mainPort})
 
     machine.succeed("curl http://127.0.0.1:${mainPort}")
+
+    # Load the Web UI config JSON and parse it.
+    webui_config_json = machine.succeed("curl http://127.0.0.1:${mainPort}/api/config")
+    webui_config = json.loads(webui_config_json)
+
+    # Check that the name was overridden via the environmentFile option.
+    assert webui_config["name"] == "${webuiName} (Open WebUI)"
   '';
 }