Reading env variables from files

Help
1

I know it’s best to have secrets in files - but some containers only support env variables.

  virtualisation.oci-containers.containers = {
    foo = {
      image = "....";
      environment = {
        USER = "foo";
        PASSWORD = "secret"; # read from file
      };
      login = {
        registry = "ghcr.io";
        username = "tcurdt";
        passwordFile = "/run/secrets/registry.github";
      };
    };

Is there an easy way to read the PASSWORD from a file instead?
Similar to the login.registry.passwordFile.

2

You can use the environmentFiles option in that same scope.

https://search.nixos.org/options?channel=23.11&show=virtualisation.oci-containers.containers.<name>.environmentFiles&from=0&size=50&sort=relevance&type=packages&query=environmentFiles

2 Likes
3

Ah, I missed that. Thanks!
Works!