···
define('DB_NAME', '${config.dbName}');
define('DB_USER', '${config.dbUser}');
+
define('DB_PASSWORD', file_get_contents('${config.dbPasswordFile}'));
define('DB_HOST', '${config.dbHost}');
define('DB_CHARSET', 'utf8');
$table_prefix = '${config.tablePrefix}';
···
+
The mysql password to the respective dbUser.
+
Warning: this password is stored in the world-readable Nix store. It's
+
recommended to use the $dbPasswordFile option since that gives you control over
+
the security of the password. $dbPasswordFile also takes precedence over $dbPassword.
+
dbPasswordFile = mkOption {
+
default = toString (pkgs.writeTextFile {
+
name = "wordpress-dbpassword";
+
text = config.dbPassword;
+
example = "/run/keys/wordpress-dbpassword";
+
Path to a file that contains the mysql password to the respective dbUser.
+
The file should be readable by the user: config.services.httpd.user.
+
$dbPasswordFile takes precedence over the $dbPassword option.
+
This defaults to a file in the world-readable Nix store that contains the value
+
of the $dbPassword option. It's recommended to override this with a path not in
+
the Nix store. Tip: use nixops key management:
+
<link xlink:href='https://nixos.org/nixops/manual/#idm140737318306400'/>
···
${pkgs.mysql}/bin/mysql -e 'CREATE DATABASE ${config.dbName};'
+
${pkgs.mysql}/bin/mysql -e "GRANT ALL ON ${config.dbName}.* TO ${config.dbUser}@localhost IDENTIFIED BY \"$(cat ${config.dbPasswordFile})\";"
echo "Good, no need to do anything database related."