Basic answer: If you don’t write secrets in your Nix configuration, they aren’t exposed on the Nix store. The best answer to this question comes from @TLATER in this discussion: Is there a way to configure email accounts without putting personal info in cleartext? (home-manager) - #10 by TLATER