From 31c2369d1fa83b0efd376b0612c26af54942588d Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Thu, 10 Sep 2026 09:24:53 -0400
Subject: [PATCH] feat(nixos): load Valheim password from sops

---
 configs/nixos/guests/valheim.nix               | 18 +++++++++++++++---
 configs/nixos/hosts/pikachu/default.nix        |  1 -
 .../nixos/modules/services/games/valheim.nix   | 17 +++++++++++------
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/configs/nixos/guests/valheim.nix b/configs/nixos/guests/valheim.nix
index b381aff..276b5bb 100644
--- a/configs/nixos/guests/valheim.nix
+++ b/configs/nixos/guests/valheim.nix
@@ -44,9 +44,10 @@ in
       description = "Base UDP port for the Valheim server.";
     };
 
-    password = lib.mkOption {
+    passwordSecret = lib.mkOption {
       type = lib.types.str;
-      description = "Valheim server password.";
+      default = "services/valheim/password";
+      description = "SOPS secret name containing the Valheim server password.";
     };
   };
 
@@ -69,8 +70,9 @@ in
     guests.valheim = {
       interior.modules.services.games.valheim = {
         enable = true;
-        inherit (cfg) serverName port password;
+        inherit (cfg) serverName port;
         inherit steamDir installDir stateDir;
+        passwordFile = "/run/secrets/${cfg.passwordSecret}";
       };
 
       mounts = {
@@ -92,6 +94,10 @@ in
           group = "storage";
           mode = "0770";
         };
+        ${"/run/secrets/${cfg.passwordSecret}"} = {
+          file = config.sops.secrets.${cfg.passwordSecret}.path;
+          readOnly = true;
+        };
       };
 
       limits = {
@@ -100,5 +106,11 @@ in
         tasksMax = lib.mkDefault 1024;
       };
     };
+
+    sops.secrets.${cfg.passwordSecret} = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+    };
   };
 }
diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index a912143..d5854e3 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -74,7 +74,6 @@
     installPath = "/pikachu/data/servers/valheim/main";
     statePath = "/pikachu/media/games/servers/valheim/main";
     serverName = "main";
-    password = "foobarbaz";
     reverseProxy = {
       enable = true;
       route = {
diff --git a/configs/nixos/modules/services/games/valheim.nix b/configs/nixos/modules/services/games/valheim.nix
index 50f0dbc..1be092d 100644
--- a/configs/nixos/modules/services/games/valheim.nix
+++ b/configs/nixos/modules/services/games/valheim.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 {
@@ -37,9 +38,9 @@
       description = "Base UDP port for the Valheim server.";
     };
 
-    password = lib.mkOption {
-      type = lib.types.str;
-      description = "Valheim server password.";
+    passwordFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Valheim server password.";
     };
 
   };
@@ -47,6 +48,12 @@
   config = lib.mkIf config.modules.services.games.valheim.enable (
     let
       service = config.modules.services.games.valheim;
+      startScript = pkgs.writeShellScript "valheim-start" ''
+        set -eu
+
+        password="$(${pkgs.coreutils}/bin/tr -d '\n' < ${lib.escapeShellArg service.passwordFile})"
+        exec ./valheim_server.x86_64 "$@" -password "$password"
+      '';
     in
     {
       modules.services.steamcmd = {
@@ -54,7 +61,7 @@
         inherit (service) steamDir installDir stateDir;
         serviceName = "valheim";
         appId = 896660;
-        executable = "./valheim_server.x86_64";
+        executable = "${startScript}";
         arguments = [
           "-nographics"
           "-batchmode"
@@ -66,8 +73,6 @@
           service.serverName
           "-savedir"
           service.stateDir
-          "-password"
-          service.password
           "-public"
           "0"
         ];