Dynamic Environment Variables / Secret Management (with sops)

[Giftzwerg02]

Hi! I'll start with stating my problem:

I am trying to configure rcon.password, setting its value via sops.
Sops requires you to read the secret at runtime, something like cat /path/to/secret
I've tried adding something along the lines of:

environmentFile = pkgs.writeText "test-file.txt" ''
	rconpwd=$(cat ${config.sops.secrets."minecraft-servers/vanilla-1/rcon-password".path})
'';

But I found out that this sets the respective systemd-setting, which does not interpolate the value and just returns $(cat <path>) as the actual string.

Am I missing another option or maybe another solution here that could work better, or do I need to manually override some settings here?

[Infinidoge]

What you would want to do would be to create a single file with all of the Minecraft server secrets, where the file contained

rconpwd=passwordhere

Then environmentFile = config.sops.secrets."secrets-file".path;
To actually make use of this, you would use serverProperties."rcon.password" = "@rconpwd@";

This isn't particularly well documented, and definitely could stand to be improved. In particular, the module does not have an option to have different environment files per-server.