15:58 <asymmetric> does anyone have tips for how to handle secrets in hm?

18:13 <hpfr> asymmetric: not sure on how secure you need, but builtins.readFile seems to be a general option if the module doesn't provide a way to specify a path in a string

18:13 <hpfr> https://discourse.nixos.org/t/in-configuration-nix-can-i-read-a-value-from-a-file/4809/2

18:14 <hpfr> there is a lot more discussion here https://github.com/NixOS/nixpkgs/issues/24288

18:14 <{^_^}> nixpkgs#24288 (by basvandijk, 2 years ago, open): Provide options for storing secrets outside the Nix store

18:35 <maralorn[m]> key.

18:35 <maralorn[m]> asymmetric: It depends on how secret you need it and for what you need the secret. I use git-crypt to have secrets in my repo which is public. Some of them land in /nix/store when used in an nix expression but it‘s a calculated risk some of them get loaded at runtime because they are referenced by absolute path and I have secrets in my password manager which get retrieved at runtime via a call to `pass` and my gpg

19:22 <hpfr> nixos-unstable updated today, readline option still doesn't exist