Issue description

Configuring credentials in NixOS is an unsolved problem, since saving them in the nix store is a bad idea (it is world-readable on a system).

A solution would be to store it outside the nix store, as state on disk (like linux user passwords), in best case with permissions, so only the service that needs it can access it.

Maybe the new "credentials" logic from Systemd 247 can solve it for us?

A new "credentials" logic has been added to system services. This is
a simple mechanism to pass privileged data to services in a safe and
secure way. It's supposed to be used to pass per-service secret data
such as passwords or cryptographic keys but also associated less
private information such as user names, certificates, and similar to
system services. Each credential is identified by a short user-chosen
name and may contain arbitrary binary data. Two new unit file
settings have been added: SetCredential= and LoadCredential=. The
former allows setting a credential to a literal string, the latter
sets a credential to the contents of a file (or data read from a
user-chosen AF_UNIX stream socket). Credentials are passed to the
service via a special credentials directory, one file for each
credential. The path to the credentials directory is passed in a new
$CREDENTIALS_DIRECTORY environment variable. Since the credentials
are passed in the file system they may be easily referenced in
ExecStart= command lines too, thus no explicit support for the
credentials logic in daemons is required (though ideally daemons
would look for the bits they need in $CREDENTIALS_DIRECTORY
themselves automatically, if set). The $CREDENTIALS_DIRECTORY is
backed by unswappable memory if privileges allow it, immutable if
privileges allow it, is accessible only to the service's UID, and is
automatically destroyed when the service stops.

Source: https://github.com/systemd/systemd/blob/6706384a89ae0c462e7172588c80667190c4d9e2/NEWS#L320

Update: Turns out this feature was added because of the discussions in NixOS/rfcs#59 (comment). So the answer is probably yes!

cc @flokli @Mic92 @aanderse @arianvp @edolstra @shlevy @d-goldin @globin

Thanks to @poettering for making this possible!

Related:

• Provide options for storing secrets outside the Nix store #24288
• nixos/ldap: unify secrets handling #64951
• systemd: 246.6 -> 247 #102355
• [RFC 0005] Nix encryption rfcs#5
• [RFC 0059]: Systemd Service Secrets rfcs#59
• [RFC 0059]: Systemd Service Secrets rfcs#59 (comment)
• credentials logic to pass privileged data to services systemd/systemd#16568
• RFE: per-service credentials system systemd/systemd#15778