feat(nixos): run Valheim in a guest

configs/nixos/modules/default.nix

@@ -42,6 +42,10 @@ in
 
     users.groups.storage.gid = 10000;
 
+    security.sudo.extraConfig = ''
+      Defaults env_keep += "EDITOR VISUAL"
+    '';
+
     time.timeZone = "America/New_York";
     i18n.defaultLocale = "en_GB.UTF-8";
 
@@ -87,6 +91,10 @@ in
 
       update = "sudo nixos-rebuild switch --flake .#${config.networking.hostName}";
       cleanup = "sudo nix-collect-garbage -d";
+      sops-host = {
+        command = "sudo --preserve-env=EDITOR,VISUAL env SOPS_AGE_KEY_FILE=/var/lib/sops-nix/key.txt nix shell nixpkgs#sops nixpkgs#neovim -c sops";
+        abbreviation = false;
+      };
     };
 
     modules.shell.fish.enable = lib.mkDefault true;

configs/nixos/modules/services/games/valheim.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 {
@@ -37,9 +38,9 @@
       description = "Base UDP port for the Valheim server.";
     };
 
-    password = lib.mkOption {
-      type = lib.types.str;
-      description = "Valheim server password.";
+    passwordFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Valheim server password.";
     };
 
   };
@@ -47,6 +48,12 @@
   config = lib.mkIf config.modules.services.games.valheim.enable (
     let
       service = config.modules.services.games.valheim;
+      startScript = pkgs.writeShellScript "valheim-start" ''
+        set -eu
+
+        password="$(${pkgs.coreutils}/bin/tr -d '\n' < ${lib.escapeShellArg service.passwordFile})"
+        exec ./valheim_server.x86_64 "$@" -password "$password"
+      '';
     in
     {
       modules.services.steamcmd = {
@@ -54,7 +61,7 @@
         inherit (service) steamDir installDir stateDir;
         serviceName = "valheim";
         appId = 896660;
-        executable = "./valheim_server.x86_64";
+        executable = "${startScript}";
         arguments = [
           "-nographics"
           "-batchmode"
@@ -66,8 +73,6 @@
           service.serverName
           "-savedir"
           service.stateDir
-          "-password"
-          service.password
           "-public"
           "0"
         ];

configs/nixos/modules/services/steamcmd.nix

@@ -113,11 +113,11 @@
 
         systemd.tmpfiles.rules = [
           "d ${service.steamDir} 0770 ${user} ${group} - -"
-          "z ${service.steamDir} 0770 ${user} ${group} - -"
+          "Z ${service.steamDir} 0770 ${user} ${group} - -"
           "d ${service.installDir} 0770 ${user} ${group} - -"
-          "z ${service.installDir} 0770 ${user} ${group} - -"
+          "Z ${service.installDir} 0770 ${user} ${group} - -"
           "d ${service.stateDir} 0770 ${user} ${group} - -"
-          "z ${service.stateDir} 0770 ${user} ${group} - -"
+          "Z ${service.stateDir} 0770 ${user} ${group} - -"
         ];
 
         systemd.services = {