Consider integration with systemd credentials for configuration secrets

[bernd]

We might want to integrate with the systemd credentials system to store configuration secrets.

See: https://systemd.io/CREDENTIALS/

[robertjakub]

Hi Bernd,

I suppose it can be something like:

[...]
[Service]
ExecStart=/nix/store/bw0gfc75z9gcj2z9jphhz24bd77ys6lf-unit-script-graylog-sidecar-start/bin/graylog-sidecar-start 
LoadCredential=API_TOKEN:/nix/store/4b060jcgy6f42hvb5zx7awqymy7z9jm6-gl_tokenapi
[...]

the gl_tokenapi is a file containing the token_api. it is loaded to the systemd-credencials using the LoadCredential.
then I modified the ExecStart to something like:

❯ command cat /nix/store/bw0gfc75z9gcj2z9jphhz24bd77ys6lf-unit-script-graylog-sidecar-start/bin/graylog-sidecar-start
#!/nix/store/kysqfpylfpl8yrmgahj1sk6yrih918gl-bash-5.3p9/bin/bash
set -e

set -eou pipefail
shopt -s inherit_errexit

API_TOKEN="$(<"$CREDENTIALS_DIRECTORY/API_TOKEN")" \
/nix/store/7qih34r990zch0y49cljsp5ghfz8pwna-graylog-sidecar-1.5.2/bin/graylog-sidecar -c /nix/store/5i5q4y17csqdpnjkdy0p5px6awj888p4-graylog-sidecar.yml

and also as you mentioned in the #526 I changed the config to: server_api_token = ${API_TOKEN}

unfortunately the systemd-credencials is the linux-specific (most of...) subsystem. it will help secure the passwords on systemd-enabled-linuxes but will not work on *bsd and legacy unixes (and also windows ((-;)