Loading environment files / secrets

[Doosty]

Hi, im doing my nvim configs and i dont see an option in the wrapper module to easily load an environment file or somehow load the contents of a file into an environment variable. Maybe something like this already exists but if not i guess this is a feature request since im not too familiar with how to modify the wrapper module myself. Thanks, loving the new way of doing things btw, coming from nixCats.

  # tried this, didnt work
  config.runShell = [
    (lib.getExe (pkgs.writeShellScriptBin "environment-secrets-for-nvim" ''
      if [ -f /run/secrets/api-keys/openrouter ]; then
        export OPENROUTER_API_KEY=''${OPENROUTER_API_KEY:-$(cat /run/secrets/api-keys/openrouter)}
      fi
    ''))
  ];

  # what would be nice to have (when the file is just the secret)
 config.env = {
    OPENROUTER_API_KEY.path = "/run/secrets/api-keys/openrouter";
  };

 # or this (when the file is already formatted as multiline VAR=VALUE env file)
 config.envFile = "/run/secrets/api-keys.env";

[BirdeeHub]

prefixContent and suffixContent option from makeWrapper module does this, kinda awkward because there is no set, but if it was not set, then it would set it.

It is not compatible with wrapperImplementation = "binary" though only the in-house implementation "nix" (the default) and "shell" (but this particular usage of it would not work with "shell" either, because that expands at build time, so, only the in-house one)

With the in-house ("nix", default) implementation you also could:

 config.env.OPENROUTER_API_KEY = {
   data = ''"$(cat /run/secrets/api-keys/openrouter)"'';
   esc-fn = v: v;
};

You can always set esc-fn but, the other 2 implementations would result in that expanding at build time so it is usually only useful in the in-house one

---

Also, you are right, this does not work

  # tried this, didnt work
  config.runShell = [
    (lib.getExe (pkgs.writeShellScriptBin "environment-secrets-for-nvim" ''
      if [ -f /run/secrets/api-keys/openrouter ]; then
        export OPENROUTER_API_KEY=''${OPENROUTER_API_KEY:-$(cat /run/secrets/api-keys/openrouter)}
      fi
    ''))
  ];

This would be the right way to do it that way (runShell also does not work with wrapperImplementation == "binary" btw, but this would run at runtime so it would actually work with the "shell" implementation)

  config.runShell = [
    ''
      if [ -f /run/secrets/api-keys/openrouter ]; then
        export OPENROUTER_API_KEY=''${OPENROUTER_API_KEY:-$(cat /run/secrets/api-keys/openrouter)}
      fi
    ''
  ];

If you were crazy you could also do it this way (don't, but hopefully it explains what was happening)

  config.runShell = [
    "source ${lib.getExe (pkgs.writeShellScriptBin "environment-secrets-for-nvim" ''
      if [ -f /run/secrets/api-keys/openrouter ]; then
        export OPENROUTER_API_KEY=''${OPENROUTER_API_KEY:-$(cat /run/secrets/api-keys/openrouter)}
      fi
    '')}"
  ];

Also, never do lib.getExe (pkgs.writeShellScriptBin instead do pkgs.writeShellScript, but you don't need either of them here

---

Also since this is neovim you are wrapping, you do have an entire lua config you can use, and you can vim.env.OPENROUTER_API_KEY if needed. This has the bonus of being compatible with all of the wrapper implementations, and can be provided from within your normal dir or from nix.

---

Also, I mentioned the binary implementation a few times, figured I would reiterate that the speed difference between all the implementations is fractions of a millisecond. The only reason to use the binary implementation is to use it in a shebang on mac, and the only reason to use the shell one over the nix one is if you really just only trust pkgs.makeWrapper and don't care that it is maybe half a millisecond slower than the nix one (It decomposes all the items.... don't ask me why I didn't write it XD) The "nix" implementation was experimental and then quickly became the default for a reason.