refactor(nixos): let navidrome service handle secrets

configs/nixos/modules/services/navidrome.nix

@@ -1,8 +1,23 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  writeEnvironmentFile = pkgs.writeShellScript "navidrome-environment" ''
+    set -eu
+
+    umask 077
+    api_key="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-api-key")"
+    secret="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-secret")"
+
+    cat > /run/navidrome/navidrome.env <<EOF
+    ND_LASTFM_APIKEY=$api_key
+    ND_LASTFM_SECRET=$secret
+    EOF
+  '';
+in
 {
   options.modules.services.navidrome = {
     enable = lib.mkEnableOption "Navidrome";
@@ -20,6 +35,16 @@
       readOnly = true;
       description = "Guest path where Navidrome reads its library folder.";
     };
+
+    lastfmApiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Navidrome Last.fm API key.";
+    };
+
+    lastfmSecretFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Navidrome Last.fm secret.";
+    };
   };
 
   config = lib.mkMerge [
@@ -39,7 +64,7 @@
         enable = true;
         user = "navidrome";
         group = "storage";
-        environmentFile = "/run/secrets/navidrome.env";
+        environmentFile = "/run/navidrome/navidrome.env";
         openFirewall = true;
         settings = {
           Address = "0.0.0.0";
@@ -49,6 +74,14 @@
           EnableSharing = true;
         };
       };
+
+      systemd.services.navidrome.serviceConfig = {
+        ExecStartPre = writeEnvironmentFile;
+        LoadCredential = [
+          "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
+          "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
+        ];
+      };
     })
   ];
 }