nixos/pocket-id: add credentials option

nixos/modules/services/security/pocket-id.nix

@@ -19,6 +19,7 @@ let
     optionalAttrs
     ;
   inherit (lib.types)
+    attrsOf
     bool
     path
     str
@@ -29,6 +30,10 @@ let
 
   format = pkgs.formats.keyValue { };
   settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
+
+  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
+  getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
 {
   meta.maintainers = with maintainers; [
@@ -51,11 +56,29 @@ in
 
         Example contents of the file:
         MAXMIND_LICENSE_KEY=your-license-key
+
+        Alternatively you can use `services.pocket-id.credentials` to define each variable in separate files.
       '';
       default = "/dev/null";
       example = "/var/lib/secrets/pocket-id";
     };
 
+    credentials = mkOption {
+      type = attrsOf path;
+      default = { };
+      example = {
+        ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key";
+      };
+      description = ''
+        Environment variables which are loaded from the contents of the specified file paths.
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+
+        Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file.
+      '';
+    };
+
     settings = mkOption {
       type = submodule {
         freeformType = format.type;
@@ -122,7 +145,7 @@ in
   config = mkIf cfg.enable {
     warnings =
       optional (cfg.settings ? MAXMIND_LICENSE_KEY)
-        "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.environmentFile` instead."
+        "`services.pocket-id.settings.MAXMIND_LICENSE_KEY` will be stored as plaintext in the Nix store. Use `services.pocket-id.credentials.MAXMIND_LICENSE_KEY` or `services.pocket-id.environmentFile` instead."
       ++
         concatMap
           (
@@ -164,12 +187,16 @@ in
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.dataDir;
-          ExecStart = getExe cfg.package;
+          ExecStart = pkgs.writeShellScript "pocket-id-start" ''
+            ${exportAllCredentials cfg.credentials}
+            ${getExe cfg.package}
+          '';
           Restart = "always";
           EnvironmentFile = [
             cfg.environmentFile
             settingsFile
           ];
+          LoadCredential = getLoadCredentialList;
 
           # Hardening
           AmbientCapabilities = "";