An audit of every NixOS module in nixpkgs that handles a real secret, classified by where the secret value ends up. The question behind it: does the secret get mixed into a configuration file, or kept separate?
- Source:
NixOS/nixpkgsat commit141f212(2026-07-20) - Scope:
nixos/modules, 2,436 module files - Modules that handle a real secret: 445
- Method: pattern scan for secret-bearing options, then per-file reading to trace each secret from its option to its final destination. False positives (boolean toggles, hashes safe to store) were removed.
| Where the secret value ends up | Modules | Share | Mixed into config? |
|---|---|---|---|
| MIX · runtime (merged into a config file at activation) | 110 | 25% | yes, not in store |
MIX · store (inlined into a config that lands in /nix/store) |
42 | 9% | yes, and world readable |
| ENV (environment variable) | 161 | 36% | no |
| FILE (app opens a dedicated secret file by path) | 58 | 13% | no |
CRED (systemd LoadCredential) |
53 | 12% | no |
| CLI (command line argument) | 19 | 4% | no |
| UNSURE | 2 |
Secrets mixed into a config file: 152 (34%). Kept separate: 291 (65%).
Buckets are assigned by each module's primary, most secret bearing path; a module was counted as mixing if any real secret value can reach a config file.
The secret value is written into a config file that lands in the world readable /nix/store. Many of these also offer a secure alternative, but the inline option still leaks if used.
| Module | Secret option | How it is delivered |
|---|---|---|
| config/users-groups.nix | users.users.*.password | serialized into users-groups.json via toJSON |
| services/audio/icecast.nix | admin.password | interpolated into icecast.xml via writeText |
| services/audio/lavalink.nix | password | merged into application.yml via format.generate |
| services/backup/bacula.nix | *.password | Password directives into bacula-*.conf via writeText |
| services/databases/cassandra.nix | jmxRoles.*.password | jmxRolesFile rendered via writeText into store |
| services/databases/lldap.nix | settings.ldap_user_pass | inlined into lldap_config.toml via format.generate |
| services/databases/mysql.nix | galeraCluster.clusterPassword | into my.cnf wsrep address; masterPassword into postStart SQL |
| services/development/athens.nix | basicAuthPass, githubToken, ... | written into config.toml via toml.generate |
| services/development/blackfire.nix | settings.server-token | environment.etc agent file via toINI |
| services/logging/graylog.nix | passwordSecret | into graylog.conf via writeText |
| services/misc/docker-registry.nix | redisPassword | into docker-registry-config.yml via toJSON |
| services/misc/gammu-smsd.nix | device.pin, backend.sql.password | writeText config emits literal directives |
| services/misc/rkvm.nix | server/client.settings.password | toml.generate into store |
| services/misc/zoneminder.nix | database.password | writeText 60-defaults.conf ZM_DB_PASS |
| services/monitoring/grafana.nix | settings.security.admin_password, ... | ini.generate config.ini (unless $__file{} provider used) |
| services/monitoring/kapacitor.nix | defaultDatabase.password, alerta.token | writeTextFile kapacitord.conf |
| services/monitoring/prometheus/default.nix | basic_auth.password, bearer_token, ... | into prometheus.yml via yaml.generate |
| services/network-filesystems/tahoe.nix | nodes.*.client.introducer | furl inlined into environment.etc .cfg |
| services/networking/cjdns.nix | connectTo.*.password, authorizedPasswords | toJSON into store activation script |
| services/networking/cntlm.nix | password | writeText cntlm.conf |
| services/networking/easytier.nix | instances.*.settings.network_secret | into easytier-*.toml |
| services/networking/inadyn.nix | settings.provider.*.password | inlined into inadyn.conf via writeText |
| services/networking/namecoind.nix | rpc.password | rpcpassword into namecoin.conf via writeText |
| services/networking/nntp-proxy.nix | upstreamPassword | cleartext into nntp-proxy.conf via writeText |
| services/networking/redsocks.nix | redsocks.*.password | inlined into redsocks.conf via writeText |
| services/networking/strongswan-swanctl/swanctl-params.nix | swanctl.secrets.*.secret | rendered into swanctl.conf via writeText |
| services/networking/umurmur.nix | settings.password | inlined into umurmur.conf via writeTextFile |
| services/networking/wasabibackend.nix | rpc.password | into wasabibackend.conf via writeText toJSON |
| services/networking/wg-quick.nix | privateKey, peers.presharedKey | inline keys into .conf via writeTextFile |
| services/networking/wpa_supplicant.nix | networks.*.psk | plaintext psk into nixos.conf |
| services/networking/znc/options.nix | confOptions.networks.*.password | writeText znc-generated.conf |
| services/security/hologram-server.nix | ldapBindPassword | into hologram-server.json via writeText toJSON |
| services/security/tor.nix | settings.HidServAuth | torrc writeText inlines auth cookie |
| services/system/userborn.nix | users.users.*.hashedPassword | into userborn.json via toJSON |
| services/torrent/bitmagnet.nix | settings.postgres.password | into config.yml via toYAML (environment.etc) |
| services/web-apps/flarum.nix | initialAdminPassword, database.password | writeText config.json via toJSON |
| services/web-apps/icingaweb2/module-monitoring.nix | transports.*.password | environment.etc commandtransports.ini |
| services/web-apps/immichframe.nix | settings.Accounts.*.ApiKey | Settings.json via format.generate |
| services/web-apps/kasmweb/default.nix | redisPassword, defaultAdminPassword, ... | replaceVarsWith init script |
| services/web-apps/mattermost.nix | database.password | into config.json DataSource via format.generate |
| services/web-apps/selfoss.nix | database.password | writeText selfoss-config.ini |
| services/web-apps/tt-rss.nix | feedCryptKey, email.password | inlined into config.php via writeText |
The secret is read from a file, credential, or env at activation and merged into a config file in /run, /etc, or a state directory. Not world readable, but config and secret coexist in one file assembled by per module glue (envsubst, replace-secret, jq/yq merge, sed).
| Module | Secret option | How it is delivered |
|---|---|---|
| config/ldap.nix | users.ldap.bind.passwordFile | preStart cats bindpw into ldap.conf / nslcd.conf |
| config/mysql.nix | users.mysql.passwordFile | appends password into pam_mysql.conf |
| programs/nncp.nix | programs.nncp.secrets | jq merges key files into /run/nncp.hjson |
| security/duosec.nix | security.duosec.secretKeyFile | cats skey into login_duo.conf / pam_duo.conf |
| services/audio/mpd.nix | credentials.*.passwordFile | replace-secret into /run/mpd/mpd.conf |
| services/audio/mpdscribble.nix | passwordFile | replace-secret into /run/mpdscribble/mpdscribble.conf |
| services/continuous-integration/buildkite-agents.nix | tokenPath | cats token into buildkite-agent.cfg |
| services/continuous-integration/gitlab-runner/runner.nix | authenticationTokenConfigFile | register writes token into config.toml |
| services/continuous-integration/jenkins/job-builder.nix | accessTokenFile | replace-secret into a runtime auth file |
| services/development/zammad.nix | database.passwordFile, secretKeyBaseFile | cats into database.yml and secrets.yml |
| services/editors/infinoted.nix | passwordFile | heredoc inlines password into infinoted.conf |
| services/games/archisteamfarm.nix | ipcPasswordFile | replace-secret into config/ASF.json |
| services/games/factorio.nix | extraSettingsFile | jq merged into server-settings.json |
| services/games/teeworlds.nix | environmentFile | envsubst into /run/teeworlds/teeworlds.yaml |
| services/home-automation/evcc.nix | environmentFile | envsubst into /run/evcc/config.yaml |
| services/home-automation/zwave-js.nix | secretsConfigFile | jq merges secrets.json into /run/zwave-js/config.json |
| services/mail/mailman.nix | restApiPassFile | replace-secret into /etc/mailman.cfg |
| services/mail/sympa.nix | database.passwordFile | preStart appends db_passwd into sympa.conf |
| services/matrix/dendrite.nix | environmentFile | envsubst into /run/dendrite/dendrite.yaml |
| services/matrix/mautrix-discord.nix | environmentFile | envsubst into config.yaml |
| services/matrix/mautrix-meta.nix | instances.*.environmentFile | envsubst into config.yaml |
| services/matrix/mautrix-signal.nix | environmentFile | envsubst + yq into config.yaml |
| services/matrix/mautrix-telegram.nix | environmentFile | envsubst into config.json |
| services/matrix/mautrix-whatsapp.nix | environmentFile | envsubst + yq into config.yaml |
| services/matrix/mjolnir.nix | accessTokenFile | replace-secret in default.yaml |
| services/misc/bcg.nix | mqtt.password | envsubst into bcg.config.yaml |
| services/misc/bepasty.nix | servers.*.secretKeyFile | writes SECRET_KEY into bepasty-*.conf |
| services/misc/blenderfarm.nix | basicSecurityPasswordFile | sed into ServerSettings JSON |
| services/misc/forgejo.nix | secrets | environment-to-ini writes into app.ini |
| services/misc/gitea.nix | database.passwordFile | replace-secret into app.ini |
| services/misc/gitlab.nix | secrets.secretFile | replace-secret into gitlab.yml, database.yml, ... |
| services/misc/mqtt2influxdb.nix | mqtt.password, influxdb.password | envsubst into config yaml |
| services/misc/nitter.nix | Config.hmacKey | replaces @hmac@ in nitter.conf |
| services/misc/omnom.nix | passwordFile | yq merges into config.yml |
| services/misc/redmine.nix | database.passwordFile | sed into database.yml |
| services/misc/sssd.nix | environmentFile | envsubst into sssd.conf |
| services/misc/turn-rs.nix | secretFile | envsubst into /run/turn-rs/config.toml |
| services/monitoring/librenms.nix | database.passwordFile, environmentFile | cats into .env and envsubst into config.json |
| services/monitoring/longview.nix | mysqlPasswordFile | writes username+password into MySQL.conf |
| services/monitoring/nezha-agent.nix | clientSecretFile | jq merges into config.json |
| services/monitoring/nezha.nix | jwtSecretFile, agentSecretFile | jq merges into config.yaml |
| services/monitoring/parsedmarc.nix | settings.*._secret | replace-secret into /run/parsedmarc/parsedmarc.ini |
| services/monitoring/prometheus/alertmanager.nix | environmentFile | envsubst into alertmanager.yml |
| services/monitoring/prometheus/exporters/dmarc.nix | imap.passwordFile | envsubst into dmarc-exporter.json |
| services/monitoring/prometheus/exporters/junos-czerwonk.nix | environmentFile | envsubst into junos-exporter.json |
| services/monitoring/prometheus/exporters/mail.nix | environmentFile | envsubst into mail-exporter.json |
| services/monitoring/scrutiny.nix | settings.web.influxdb.token | genJqSecretsReplacementSnippet into /run/scrutiny/config.yaml |
| services/monitoring/telegraf.nix | environmentFiles | envsubst into /var/run/telegraf/config.toml |
| services/monitoring/traccar.nix | environmentFile | envsubst into config.xml |
| services/monitoring/ups.nix | users.*.passwordFile | replace-secret into upsd.users / upsmon.conf |
| services/monitoring/zabbix-proxy.nix | database.passwordFile | writes DBPassword into /run include file |
| services/monitoring/zabbix-server.nix | database.passwordFile | writes DBPassword into /run include file |
| services/networking/amuled.nix | ExternalConnectPasswordFile | crudini writes md5 into amule.conf |
| services/networking/aria2.nix | rpcSecretFile | echo rpc-secret into aria2.conf |
| services/networking/biboumi.nix | credentialsFile | cats into /run/biboumi/biboumi.cfg |
| services/networking/blockbook-frontend.nix | rpc.passwordFile | jq into config.json |
| services/networking/coturn.nix | static-auth-secret-file | replace-secret into /run/coturn/turnserver.cfg |
| services/networking/ddclient.nix | passwordFile, secretsFile | replace-secret into /run/ddclient/ddclient.conf |
| services/networking/gns3-server.nix | auth.passwordFile | replace-secret into gns3_server.conf |
| services/networking/go-neb.nix | secretFile | envsubst into /var/run/go-neb/config.yaml |
| services/networking/hostapd.nix | authentication.wpaPasswordFile | cat/tr secret files into /run/hostapd conf |
| services/networking/jigasi.nix | userPasswordFile, environmentFile | sed + envsubst into sip-communicator.properties |
| services/networking/keepalived/default.nix | secretFile | envsubst into /run/keepalived/keepalived.conf |
| services/networking/monero.nix | environmentFile | envsubst into monerod.conf |
| services/networking/murmur.nix | environmentFile | envsubst into murmurd.ini |
| services/networking/netbird/coturn.nix | passwordFile | replace-secret into turnserver.cfg |
| services/networking/networkmanager.nix | ensureProfiles.environmentFiles | envsubst into .nmconnection profiles |
| services/networking/powerdns.nix | secretFile | envsubst into /run/pdns/pdns.conf |
| services/networking/rathole.nix | credentialsFile | py-toml-merge into /run/rathole/merged.toml |
| services/networking/resilio.nix | sharedFolders.*.secretFile | jq into /run/rslsync/config.json |
| services/networking/sabnzbd/default.nix | secretFiles, secretValues | config_merge / replace-secret into sabnzbd.ini |
| services/networking/searx.nix | environmentFile | envsubst into settings.yml |
| services/networking/shadowsocks.nix | passwordFile | jq into /tmp/shadowsocks.json |
| services/networking/syncthing.nix | settings.folders...encryptionPasswordFile | jq / mkpasswd POSTed into config.xml |
| services/networking/wg-access-server.nix | secretsFile | yq merges into config.yml |
| services/security/crowdsec-firewall-bouncer.nix | secrets.apiKeyPath | replace-secret into config.yaml |
| services/torrent/transmission.nix | credentialsFile | jq merges rpc-password into settings.json |
| services/video/epgstation/default.nix | database.passwordFile | sed into config.yml |
| services/web-apps/agorakit.nix | config.*._secret | replace-secret into .env |
| services/web-apps/akkoma.nix | config.*._secret | replace-secret into config.exs |
| services/web-apps/castopod.nix | database.passwordFile | appends into .env |
| services/web-apps/davis.nix | config.*._secret | replace-secret into .env.local |
| services/web-apps/dex.nix | settings.staticClients.*.secretFile | replace-secret into /run/dex/config.yaml |
| services/web-apps/discourse.nix | secretKeyBaseFile | replace-secret into discourse.conf |
| services/web-apps/glance.nix | settings.*._secret | genJqSecretsReplacementSnippet into /run/glance/glance.yaml |
| services/web-apps/hedgedoc.nix | environmentFile | envsubst into /run/hedgedoc/config.json |
| services/web-apps/immich.nix | settings.*._secret | genJqSecretsReplacement into /run/immich/config.json |
| services/web-apps/invidious.nix | database.passwordFile | jq merge delivered via INVIDIOUS_CONFIG env |
| services/web-apps/kavita.nix | tokenKeyFile | replace-secret into appsettings.json |
| services/web-apps/keycloak.nix | database.passwordFile, settings.*._secret | replace-secret into keycloak.conf |
| services/web-apps/kimai.nix | database.passwordFile | cats into DATABASE_URL in .env |
| services/web-apps/lanraragi.nix | redis.passwordFile | writes redis_password into lrr.conf |
| services/web-apps/lemmy.nix | smtpPasswordFile, adminPasswordFile, ... | genJqSecretsReplacementSnippet into /run/lemmy/config.hjson |
| services/web-apps/librespeed.nix | secrets | cats into /run config.toml |
| services/web-apps/misskey.nix | database.passwordFile, redis.passwordFile | replace-secret into /run/misskey/default.yml |
| services/web-apps/monica.nix | config._secret | replace-secret into .env |
| services/web-apps/movim.nix | secretFile | cat >> .env |
| services/web-apps/onlyoffice.nix | jwtSecretFile, postgresPasswordFile | jq into /run/onlyoffice/config/default.json |
| services/web-apps/part-db.nix | environmentFile | cat >> env.local |
| services/web-apps/peering-manager.nix | environmentFile | envsubst into configuration.py |
| services/web-apps/peertube.nix | secrets.secretsFile, database.passwordFile | cats into config/local.yaml |
| services/web-apps/peertube-runner.nix | registrationTokenFile | runnerToken into config.toml |
| services/web-apps/pixelfed.nix | secretFile | cat >> .env |
| services/web-apps/snipe-it.nix | config.*._secret | replace-secret into .env |
| services/web-apps/stash.nix | jwtSecretKeyFile, sessionStoreKeyFile | yq merges into config.yml |
| services/web-apps/suwayomi-server.nix | basicAuthPasswordFile | envsubst into server.conf |
| services/web-apps/szurubooru.nix | server.settings.secretFile, ... | envsubst into config.yaml |
| services/web-apps/writefreely.nix | database.passwordFile, email.smtpPasswordFile | sed into config.ini |
| services/web-servers/traefik.nix | environmentFiles | envsubst into /run/traefik/config.toml |
| system/boot/loader/grub/grub.nix | users.*.hashedPasswordFile | install-grub.pl writes into grub.cfg |
Secret delivered as an environment variable (systemd EnvironmentFile= or Environment= from a credential) and read by the app. Not written into a config file.
| Module | Secret option |
|---|---|
| security/acme/default.nix | certs.*.environmentFile |
| services/admin/komodo-periphery.nix | auth.privateKey, environmentFile |
| services/audio/navidrome.nix | environmentFile |
| services/backup/borgbackup.nix | encryption.passphrase / passCommand |
| services/backup/duplicity.nix | secretFile |
| services/backup/restic.nix | environmentFile, passwordFile |
| services/cluster/patroni/default.nix | environmentFiles |
| services/continuous-integration/gitea-actions-runner.nix | tokenFile |
| services/continuous-integration/woodpecker/agents.nix | environmentFile |
| services/continuous-integration/woodpecker/server.nix | environmentFile |
| services/development/livebook.nix | environmentFile |
| services/development/turborepo-remote-cache.nix | environmentFile |
| services/home-automation/deye-dummycloud.nix | mqttPassword (inline in Environment=, store readable) |
| services/home-automation/esphome.nix | environmentFile |
| services/home-automation/govee2mqtt.nix | environmentFile |
| services/home-automation/homebridge.nix | environmentFile |
| services/mail/listmonk.nix | secretFile |
| services/mail/rspamd-trainer.nix | secrets |
| services/matrix/conduit.nix | secretFile |
| services/matrix/hebbot.nix | botPasswordFile |
| services/matrix/matrix-alertmanager.nix | secretFile, tokenFile |
| services/matrix/tuwunel.nix | environmentFile |
| services/misc/anki-sync-server.nix | users.passwordFile |
| services/misc/atuin.nix | environmentFile |
| services/misc/cfdyndns.nix | apiTokenFile, apikeyFile |
| services/misc/db-rest.nix | redis.passwordFile |
| services/misc/docling-serve.nix | environmentFile |
| services/misc/duckdns.nix | tokenFile |
| services/misc/gotenberg.nix | environmentFile |
| services/misc/homepage-dashboard.nix | environmentFiles |
| services/misc/litellm.nix | environmentFile |
| services/misc/memos.nix | environmentFile |
| services/misc/mollysocket.nix | environmentFile |
| services/misc/ntfy-sh.nix | environmentFile |
| services/misc/open-webui.nix | environmentFile |
| services/misc/orthanc.nix | environmentFile |
| services/misc/pghero.nix | environmentFiles |
| services/misc/pinchflat.nix | secretsFile |
| services/misc/podgrab.nix | passwordFile |
| services/misc/pufferpanel.nix | environmentFile |
| services/misc/rmfakecloud.nix | environmentFile |
| services/misc/tdarr/node.nix | environmentFile |
| services/misc/tdarr/server.nix | environmentFile |
| services/misc/transfer-sh.nix | secretFile |
| services/misc/wastebin.nix | secretFile |
| services/misc/workout-tracker.nix | environmentFile |
| services/monitoring/alloy.nix | environmentFile |
| services/monitoring/beszel-agent.nix | environmentFile |
| services/monitoring/beszel-hub.nix | environmentFile |
| services/monitoring/datadog-agent.nix | apiKeyFile |
| services/monitoring/flap-alerted.nix | environmentFiles |
| services/monitoring/gatus.nix | environmentFile |
| services/monitoring/gs1200-exporter.nix | passwordFile |
| services/monitoring/prometheus/alertmanager-gotify-bridge.nix | environmentFile |
| services/monitoring/prometheus/exporters/artifactory.nix | artiPassword (inline in Environment=, store readable) |
| services/monitoring/prometheus/exporters/bitcoin.nix | rpcPasswordFile |
| services/monitoring/prometheus/exporters/buildkite-agent.nix | tokenPath |
| services/monitoring/prometheus/exporters/deluge.nix | delugePasswordFile |
| services/monitoring/prometheus/exporters/ecoflow.nix | ecoflow*KeyFile |
| services/monitoring/prometheus/exporters/elasticsearch.nix | environmentFile |
| services/monitoring/prometheus/exporters/fastly.nix | environmentFile |
| services/monitoring/prometheus/exporters/kafka.nix | environmentFile |
| services/monitoring/prometheus/exporters/mqtt.nix | environmentFile |
| services/monitoring/prometheus/exporters/nut.nix | passwordPath |
| services/monitoring/prometheus/exporters/php-fpm.nix | environmentFile |
| services/monitoring/prometheus/exporters/postgres.nix | environmentFile |
| services/monitoring/prometheus/exporters/sabnzbd.nix | apiKeyFile |
| services/monitoring/prometheus/exporters/snmp.nix | environmentFile |
| services/monitoring/prometheus/exporters/tailscale.nix | environmentFile |
| services/monitoring/prometheus/exporters/tibber.nix | apiTokenPath |
| services/network-filesystems/ipfs-cluster.nix | secretFile |
| services/network-filesystems/litestream/default.nix | environmentFile |
| services/network-filesystems/webdav.nix | environmentFile |
| services/networking/atticd.nix | environmentFile |
| services/networking/cloudflare-ddns.nix | credentialsFile |
| services/networking/fedimintd.nix | bitcoin.rpc.secretFile |
| services/networking/firefox-syncserver.nix | secrets |
| services/networking/firezone/relay.nix | tokenFile |
| services/networking/firezone/server.nix | settingsSecret, smtp.passwordFile |
| services/networking/frp.nix | environmentFiles |
| services/networking/jibri/default.nix | *.login.passwordFile |
| services/networking/jicofo.nix | userPasswordFile |
| services/networking/jitsi-videobridge.nix | xmppConfigs.*.passwordFile |
| services/networking/livekit-ingress.nix | environmentFile |
| services/networking/ncps.nix | cache.redis.passwordFile, ... |
| services/networking/newt.nix | environmentFile |
| services/networking/oink.nix | apiKeyFile, secretApiKeyFile |
| services/networking/pangolin.nix | environmentFile, gerbil.environmentFile |
| services/networking/porxie.nix | environmentFiles |
| services/networking/r53-ddns.nix | environmentFile |
| services/networking/syncplay.nix | passwordFile |
| services/networking/tap.nix | environmentFiles |
| services/networking/wstunnel.nix | environmentFile |
| services/scheduling/prefect.nix | databasePasswordFile |
| services/search/typesense.nix | apiKeyFile |
| services/security/pocket-id.nix | credentials |
| services/security/tinyauth.nix | environmentFile |
| services/security/tsidp.nix | environmentFile |
| services/security/vaultwarden/default.nix | environmentFile |
| services/system/cachix-agent/default.nix | credentialsFile |
| services/system/cachix-watch-store.nix | cachixTokenFile |
| services/web-apps/bluesky-pds.nix | environmentFiles |
| services/web-apps/changedetection-io.nix | environmentFile |
| services/web-apps/chhoto-url.nix | environmentFiles |
| services/web-apps/cocoon.nix | environmentFiles |
| services/web-apps/coder.nix | environment.file |
| services/web-apps/commafeed.nix | environmentFile |
| services/web-apps/dawarich.nix | secretKeyBaseFile |
| services/web-apps/docuseal.nix | secretKeyBaseFile |
| services/web-apps/fider.nix | environmentFiles |
| services/web-apps/glitchtip.nix | environmentFiles |
| services/web-apps/gotify-server.nix | environmentFiles |
| services/web-apps/gotosocial.nix | environmentFile |
| services/web-apps/haven.nix | environmentFile |
| services/web-apps/isso.nix | secretFile |
| services/web-apps/karakeep.nix | environmentFile |
| services/web-apps/koito.nix | environmentFile |
| services/web-apps/lauti.nix | secrets |
| services/web-apps/librechat.nix | credentials, credentialsFile |
| services/web-apps/linkding.nix | environmentFile |
| services/web-apps/linkwarden.nix | environmentFile, secretFiles |
| services/web-apps/lubelogger.nix | environmentFile |
| services/web-apps/mastodon.nix | database.passwordFile, secretKeyBaseFile |
| services/web-apps/mealie.nix | credentialsFile |
| services/web-apps/microbin.nix | passwordFile |
| services/web-apps/miniflux.nix | adminCredentialsFile |
| services/web-apps/nextcloud-whiteboard-server.nix | secrets |
| services/web-apps/ocis.nix | environmentFile |
| services/web-apps/outline.nix | secretKeyFile, ... |
| services/web-apps/papra.nix | environmentFile |
| services/web-apps/pdfding.nix | secretKeyFile, database.passwordFile |
| services/web-apps/pretalx.nix | environmentFiles |
| services/web-apps/pretix.nix | environmentFile |
| services/web-apps/readeck.nix | environmentFile |
| services/web-apps/remark42.nix | environmentFile |
| services/web-apps/reposilite.nix | database.passwordFile, keyPasswordFile |
| services/web-apps/rsshub.nix | secretFiles |
| services/web-apps/rustical.nix | environmentFiles |
| services/web-apps/screego.nix | environmentFile |
| services/web-apps/sharkey.nix | environmentFiles |
| services/web-apps/shiori.nix | environmentFile |
| services/web-apps/slskd.nix | environmentFile |
| services/web-apps/snips-sh.nix | environmentFile |
| services/web-apps/stirling-pdf.nix | environmentFiles |
| services/web-apps/strichliste.nix | environmentFiles |
| services/web-apps/stump.nix | secretFiles, environmentFile |
| services/web-apps/tranquil-pds.nix | environmentFiles |
| services/web-apps/trilium.nix | environmentFile |
| services/web-apps/vikunja.nix | environmentFiles |
| services/web-apps/wakapi.nix | environmentFiles |
| services/web-apps/wiki-js.nix | environmentFile |
| services/web-apps/zipline.nix | environmentFiles |
| services/web-servers/caddy/default.nix | environmentFile |
| services/web-servers/garage.nix | environmentFile |
| services/web-servers/keter/default.nix | bundle.secretScript |
| services/web-servers/minio.nix | rootCredentialsFile |
| services/web-servers/pomerium.nix | secretsFile |
| services/web-servers/rustfs.nix | environmentFile |
| services/web-servers/send.nix | environmentFile |
| virtualisation/oci-containers.nix | environmentFiles, login.passwordFile |
Secret stays in its own dedicated file; the app is handed the path and opens it itself. Value never inlined into a config.
| Module | Secret option |
|---|---|
| security/pam.nix | u2f.settings.authfile, ... |
| services/blockchain/ethereum/geth.nix | authrpc.jwtsecret |
| services/cluster/kubernetes/apiserver.nix | tlsKeyFile, tokenAuthFile, ... |
| services/cluster/kubernetes/default.nix | kubeconfig.keyFile |
| services/cluster/kubernetes/pki.nix | certs.*.key |
| services/continuous-integration/hercules-ci-agent/settings.nix | clusterJoinTokenPath, ... |
| services/databases/etcd.nix | keyFile, peerKeyFile |
| services/databases/neo4j.nix | ssl.policies.*.privateKey |
| services/logging/journaldriver.nix | applicationCredentials |
| services/mail/pfix-srsd.nix | secretsFile |
| services/mail/roundcube.nix | database.passwordFile |
| services/matrix/appservice-irc.nix | passwordEncryptionKeyPath |
| services/misc/devpi-server.nix | secretFile |
| services/misc/inventree.nix | secretKeyFile |
| services/misc/mackerel-agent.nix | apiKeyFile |
| services/monitoring/prometheus/exporters/nextcloud.nix | passwordFile, tokenFile |
| services/networking/iodine.nix | passwordFile |
| services/networking/iperf3.nix | rsaPrivateKey, authorizedUsersFile |
| services/networking/mosquitto.nix | users.*.passwordFile |
| services/networking/openconnect.nix | passwordFile |
| services/networking/openvpn.nix | authUserPass |
| services/networking/pleroma.nix | secretConfigFile |
| services/networking/quicktun.nix | privateKeyFile |
| services/networking/shellhub-agent.nix | privateKey |
| services/networking/ssh/sshd.nix | hostKeys |
| services/networking/strongswan.nix | secrets |
| services/networking/tinc.nix | ed25519PrivateKeyFile, rsaPrivateKeyFile |
| services/networking/ucarp.nix | passwordFile |
| services/networking/wireguard.nix | privateKeyFile |
| services/networking/zeronsd.nix | servedNetworks.*.settings.token |
| services/search/nominatim.nix | database.passwordFile |
| services/security/canaille.nix | secretKeyFile, smtpPasswordFile, ... |
| services/security/crowdsec.nix | settings.lapi.credentialsFile |
| services/security/kanidm.nix | server.settings.tls_key, ... |
| services/security/munge.nix | password (key path) |
| services/security/vault.nix | extraSettingsPaths |
| services/torrent/magnetico.nix | web.credentialsFile |
| services/web-apps/anuko-time-tracker.nix | settings.email.smtpPasswordFile |
| services/web-apps/cloudlog.nix | database.passwordFile |
| services/web-apps/dolibarr.nix | database.passwordFile |
| services/web-apps/froide-govplan.nix | secretKeyFile |
| services/web-apps/invoiceplane.nix | database.passwordFile |
| services/web-apps/lasuite-docs.nix | secretKeyPath |
| services/web-apps/lasuite-drive.nix | secretKeyPath |
| services/web-apps/lasuite-meet.nix | secretKeyPath, livekit.keyFile |
| services/web-apps/mediawiki.nix | database.passwordFile |
| services/web-apps/moodle.nix | database.passwordFile |
| services/web-apps/netbox.nix | secretKeyFile, apiTokenPepperFiles |
| services/web-apps/oncall.nix | secretFile |
| services/web-apps/openvscode-server.nix | connectionTokenFile |
| services/web-apps/powerdns-admin.nix | secretKeyFile, saltFile |
| services/web-apps/weblate.nix | djangoSecretKeyFile, smtp.passwordFile |
| services/web-apps/wordpress.nix | database.passwordFile |
| services/web-apps/zabbix.nix | database.passwordFile |
| system/boot/clevis.nix | devices.*.secretFile |
| system/boot/luksroot.nix | luks.devices.*.keyFile |
| system/boot/networkd.nix | wireguard PrivateKeyFile, PresharedKeyFile |
| system/boot/stage-1.nix | boot.initrd.secrets |
Secret loaded via systemd LoadCredential; the app reads it from $CREDENTIALS_DIRECTORY.
| Module | Secret option |
|---|---|
| services/admin/pgadmin.nix | initialPasswordFile, emailServer.passwordFile |
| services/blockchain/ethereum/erigon.nix | secretJwtPath |
| services/databases/postgrest.nix | jwtSecretFile, pgpassFile |
| services/databases/postgres-websockets.nix | jwtSecretFile, pgpassFile |
| services/databases/victorialogs.nix | basicAuthPasswordFile |
| services/databases/victoriametrics.nix | basicAuthPasswordFile |
| services/databases/victoriatraces.nix | basicAuthPasswordFile |
| services/home-automation/home-assistant-matter-hub.nix | accessTokenFile |
| services/mail/postsrsd.nix | secretsFile |
| services/mail/stalwart.nix | credentials |
| services/matrix/draupnir.nix | secrets.accessToken |
| services/matrix/matrix-authentication-service.nix | credentials |
| services/misc/autobrr.nix | secretFile |
| services/misc/hyprwhspr-rs.nix | environmentFile |
| services/misc/paperless.nix | passwordFile |
| services/misc/radicle.nix | privateKey |
| services/misc/renovate.nix | credentials |
| services/misc/yarr.nix | authFilePath |
| services/monitoring/netdata.nix | claimTokenFile |
| services/monitoring/prometheus/exporters/exportarr.nix | apiKeyFile |
| services/monitoring/prometheus/exporters/opnsense.nix | apiKeyFile, apiSecretFile |
| services/monitoring/prometheus/exporters/pve.nix | configFile |
| services/monitoring/prometheus/exporters/restic.nix | passwordFile |
| services/monitoring/prometheus/exporters/storagebox.nix | tokenFile |
| services/monitoring/vlagent.nix | remoteWrite.basicAuthPasswordFile |
| services/monitoring/vmagent.nix | remoteWrite.basicAuthPasswordFile |
| services/networking/centrifugo.nix | credentials |
| services/networking/cloudflared.nix | tunnels.*.credentialsFile |
| services/networking/cloudflare-dyndns.nix | apiTokenFile |
| services/networking/firezone/gateway.nix | tokenFile |
| services/networking/firezone/headless-client.nix | tokenFile |
| services/networking/godns.nix | loadCredential |
| services/networking/nix-serve.nix | secretKeyFile |
| services/networking/nomad.nix | credentials |
| services/networking/wgautomesh.nix | gossipSecretFile |
| services/networking/yggdrasil.nix | settings.PrivateKeyPath |
| services/security/authelia.nix | secrets.*File |
| services/security/oauth2-proxy.nix | clientSecretFile |
| services/security/step-ca.nix | intermediatePasswordFile |
| services/torrent/qui.nix | secretFile |
| services/web-apps/c2fmzq-server.nix | passphraseFile |
| services/web-apps/dependency-track.nix | database.passwordFile |
| services/web-apps/drasl.nix | settings.RegistrationOIDC.*.ClientSecretFile |
| services/web-apps/honk.nix | passwordFile |
| services/web-apps/limesurvey.nix | encryptionKeyFile, encryptionNonceFile |
| services/web-apps/nextcloud.nix | config.dbpassFile, adminpassFile, secrets |
| services/web-apps/photoprism.nix | passwordFile, databasePasswordFile |
| services/web-apps/photoview.nix | database.passwordFile |
| services/web-apps/plausible.nix | server.secretKeybaseFile, ... |
| services/web-apps/wealthfolio.nix | secretKeyFile, authPasswordHashFile |
| services/web-apps/your_spotify.nix | spotifySecretFile |
| virtualisation/credentials-options.nix | credentials.*.text/source |
| virtualisation/qemu-vm.nix | credentials |
Secret passed as a command line argument in ExecStart.
| Module | Secret option |
|---|---|
| services/audio/hqplayerd.nix | auth.password |
| services/cluster/rancher/default.nix | token, agentToken |
| services/continuous-integration/github-runner/options.nix | tokenFile |
| services/databases/influxdb2.nix | provision.initialSetup.passwordFile, tokenFile |
| services/databases/mongodb.nix | initialRootPasswordFile |
| services/games/terraria.nix | password |
| services/home-automation/ebusd.nix | mqtt.password |
| services/mail/maddy.nix | ensureCredentials.*.passwordFile |
| services/monitoring/cadvisor.nix | storageDriverPasswordFile |
| services/monitoring/prometheus/exporters/fail2ban.nix | passwordFile |
| services/monitoring/prometheus/exporters/klipper.nix | moonrakerApiKey |
| services/monitoring/prometheus/exporters/pihole.nix | apiToken, password |
| services/network-filesystems/yandex-disk.nix | password |
| services/networking/hans.nix | passwordFile, server.passwordFile |
| services/networking/microsocks.nix | authPasswordFile |
| services/web-apps/freshrss.nix | passwordFile, database.passFile |
| services/web-apps/jitsi-meet.nix | videobridge.passwordFile |
| services/web-apps/nifi.nix | initPasswordFile |
| services/web-servers/ttyd.nix | passwordFile |
| Module | Note |
|---|---|
| programs/ssh.nix | knownHosts.publicKey is public key material, not a secret |
| services/web-apps/drupal.nix | database.passwordFile option declared but not wired into any generated config |
Audit assisted by Claude Opus 4.8. Methodology: heuristic option scan plus per-file reading; each module bucketed by its primary secret bearing path, counted as mixing if any real secret value can reach a config file. Modules often support several paths, so treat the mixing figure as "mixing happens at all," not "no separate option exists."