Nix¶

{ config, lib, pkgs, ... }:

let
  inherit (lib) mkEnableOption mkOption mkIf getExe types;

  cfg = config.services.myservice;
in
{
  options.services.myservice = {
    enable = mkEnableOption "fictional myservice daemon";

    package = mkOption {
      type = types.package;
      default = pkgs.myservice;
      description = "The package providing the myservice binary.";
    };

    authSecretPath = mkOption {
      type = types.externalPath; # Correct type for sensitive external files
      description = "Path to the file containing the authentication secret.";
      example = "/run/secrets/myservice-auth";
    };
  };

  config = mkIf cfg.enable {
    systemd.services.myservice = {
      description = "MyService Daemon";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];

      script = ''
        export AUTH_SECRET="$(< "$CREDENTIALS_DIRECTORY/auth_secret")"
        exec ${getExe cfg.package}
      '';

      serviceConfig = {
        Type = "simple";
        DynamicUser = true;
        # LoadCredential is safe; it reads the file at runtime and
        # makes it available in the private credentials directory.
        LoadCredential = "auth_secret:${cfg.authSecretPath}";
      };
    };
  };
}