Re: Another service definition question: Files containing secrets?

[Hartmut Goebel <h.goebel@crazy-compilers.com>]

Hi,

Am 28.07.24 um 23:27 schrieb Zack Weinberg:
> The*problem*  with this is that it appears there's no way to make a file
> in the store not be world readable.
>
> What's the best way to deal with this situation?

I feel your pain! Several years ago already I started a nullmailer 
service for Guix - and never finished it for similar reasons. 
(nullmailer expects the password being part of the config file.)

I'm afraid, the only solution is to create a service which generates the 
config at boot time from a file containing the password and some 
template (or guile data structure). The password file would not be part 
of the Guix system definition. Anyhow I'm not aware of any example, sorry.

Please let me know if you implement something like this as I'd like to 
eventally finish the nullmailer service :-)

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          |h.goebel@crazy-compilers.com                |
|www.crazy-compilers.com  | compilers which you thought are impossible |