From c3deadcb06e7d344e09dffc5921991765f22ba69 Mon Sep 17 00:00:00 2001
From: Wael Nasreddine <wael.nasreddine@gmail.com>
Date: Thu, 8 Jan 2026 19:43:54 -0800
Subject: [PATCH] nixos/ncps: Add a databaseURLFile for secure configuration

---
 nixos/modules/services/networking/ncps.nix | 41 ++++++++++++++++++----
 nixos/tests/ncps-ha.nix                    |  8 ++++-
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index a3ef2c0c8be3..45733a964170 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -27,6 +27,10 @@ let
       export CACHE_REDIS_PASSWORD="$(cat "$CREDENTIALS_DIRECTORY/redisPassword")"
     ''}
 
+    ${lib.optionalString (cfg.cache.databaseURLFile != null) ''
+      export CACHE_DATABASE_URL="$(cat "$CREDENTIALS_DIRECTORY/databaseURL")"
+    ''}
+
     exec ${lib.getExe cfg.package} "$@"
   '';
 
@@ -47,10 +51,10 @@ let
   serveFlags = lib.concatStringsSep " " (
     [
       "--cache-hostname='${cfg.cache.hostName}'"
-      "--cache-database-url='${cfg.cache.databaseURL}'"
       "--cache-temp-path='${cfg.cache.tempPath}'"
       "--server-addr='${cfg.server.addr}'"
     ]
+    ++ (lib.optional (cfg.cache.databaseURL != null) "--cache-database-url='${cfg.cache.databaseURL}'")
     ++ (lib.optionals (cfg.cache.redis != null) (
       [
         "--cache-redis-addrs='${builtins.concatStringsSep "," cfg.cache.redis.addresses}'"
@@ -98,10 +102,10 @@ let
     ++ (lib.optional (cfg.netrcFile != null) "--netrc-file='${cfg.netrcFile}'")
   );
 
-  isSqlite = lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
+  isSqlite = cfg.cache.databaseURL != null && lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
 
-  dbPath = lib.removePrefix "sqlite:" cfg.cache.databaseURL;
-  dbDir = dirOf dbPath;
+  dbPath = if isSqlite then lib.removePrefix "sqlite:" cfg.cache.databaseURL else null;
+  dbDir = if isSqlite then dirOf dbPath else null;
 in
 {
   imports = [
@@ -187,7 +191,7 @@ in
         };
 
         databaseURL = lib.mkOption {
-          type = lib.types.str;
+          type = lib.types.nullOr lib.types.str;
           default = "sqlite:${cfg.cache.storage.local}/db/db.sqlite";
           defaultText = "sqlite:/var/lib/ncps/db/db.sqlite";
           description = ''
@@ -195,6 +199,14 @@ in
           '';
         };
 
+        databaseURLFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = ''
+            File containing the URL of the database.
+          '';
+        };
+
         lru = {
           schedule = lib.mkOption {
             type = lib.types.nullOr lib.types.str;
@@ -462,6 +474,10 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [
+      {
+        assertion = lib.xor (cfg.cache.databaseURL != null) (cfg.cache.databaseURLFile != null);
+        message = "You must specify exactly one of config.ncps.cache.databaseURL or config.ncps.cache.databaseURLFile";
+      }
       {
         assertion = cfg.cache.lru.schedule == null || cfg.cache.maxSize != null;
         message = "You must specify config.ncps.cache.lru.schedule when config.ncps.cache.maxSize is set";
@@ -492,7 +508,7 @@ in
           "${cfg.cache.storage.local}".d = perms;
         })
 
-        (lib.mkIf (isSqlite) { "${dbDir}".d = perms; })
+        (lib.mkIf isSqlite { "${dbDir}".d = perms; })
 
         (lib.mkIf (cfg.cache.tempPath != "/tmp") { "${cfg.cache.tempPath}".d = perms; })
       ];
@@ -505,7 +521,14 @@ in
       wantedBy = [ "multi-user.target" ];
 
       preStart = ''
-        ${cfg.package}/bin/dbmate-ncps --url="${cfg.cache.databaseURL}" up
+        ${lib.optionalString (cfg.cache.databaseURLFile != null) ''
+          export DATABASE_URL="$(cat "$CREDENTIALS_DIRECTORY/databaseURL")"
+        ''}
+        ${lib.optionalString (cfg.cache.databaseURL != null) ''
+          export DATABASE_URL="${cfg.cache.databaseURL}"
+        ''}
+        echo ${cfg.package}/bin/dbmate-ncps up
+        ${cfg.package}/bin/dbmate-ncps up
       '';
 
       serviceConfig = lib.mkMerge [
@@ -535,6 +558,10 @@ in
           LoadCredential = lib.singleton "redisPassword:${cfg.cache.redis.passwordFile}";
         })
 
+        (lib.mkIf (cfg.cache.databaseURLFile != null) {
+          LoadCredential = lib.singleton "databaseURL:${cfg.cache.databaseURLFile}";
+        })
+
         # ensure permissions on required directories
         (lib.mkIf (cfg.cache.storage.s3 == null && cfg.cache.storage.local != "/var/lib/ncps") {
           ReadWritePaths = [ cfg.cache.storage.local ];
diff --git a/nixos/tests/ncps-ha.nix b/nixos/tests/ncps-ha.nix
index c39962c0536c..e4e8759b9f7c 100644
--- a/nixos/tests/ncps-ha.nix
+++ b/nixos/tests/ncps-ha.nix
@@ -120,7 +120,13 @@ in
       ];
     };
 
-    ncps0 = ncpsAttrs "ncps0";
+    ncps0 = lib.mkMerge [
+      (ncpsAttrs "ncps0")
+      {
+        services.ncps.cache.databaseURL = lib.mkForce null;
+        services.ncps.cache.databaseURLFile = builtins.toFile "db-url" "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
+      }
+    ];
     ncps1 = ncpsAttrs "ncps1";
 
     postgres = {