From 539d81cf465483fb557ec738b51d998843fb34ee Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Fri, 2 Jan 2026 13:20:46 +0100
Subject: [PATCH] switch to systemd LoadCredential

---
 module.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/module.nix b/module.nix
index e9f322b..3de0c6c 100644
--- a/module.nix
+++ b/module.nix
@@ -95,7 +95,8 @@ in
       // lib.mapAttrs (_: v: toString v) cfg.settings;
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${lib.getExe pkgs.mail-quota-warning}${lib.optionalString (cfg.secretFile != null) " --config ${cfg.secretFile}"}";
+        LoadCredential = lib.optionalString (cfg.secretFile != null) "secrets.yaml:${cfg.secretFile}";
+        ExecStart = "${lib.getExe pkgs.mail-quota-warning}${lib.optionalString (cfg.secretFile != null) " --config \${CREDENTIALS_DIRECTORY}/secrets.yaml";
         WorkingDirectory = "%S/mail-quota-warning";
         StateDirectory = "mail-quota-warning";