nixos/ddclient: replace password with passwordFile option

[felschr]

Motivation for this change

#24288

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes (or backporting 21.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[aanderse]

Awesome PR!

[aanderse]

Thanks @felschr!

All tested? Manual builds fine? ... time to merge?

[felschr]

Yes, I've tested various options locally, it all works as expected.
Manual should be fine as far as I can tell (first time I changed it). I invoked the update script after the markdown changes as required.
From my point, it's good to merge.

[aanderse]

Great! Thank you for your contribution 🚀

[arcnmx]

@felschr @aanderse Given that ddclient is DynamicUser=true and doesn't use a privileged ExecStartPre to generate the config, what are the intended permissions for passwordFile that would allow the service to read it without the password being world-readable?

EDIT: also configFile may contain passwords, and should be similarly handled.

[aanderse]

@arcnmx I missed that! So this PR doesn't actually improve things... yet! Thanks for bringing this up.
@felschr can you please create a PR to utilize LoadCredential so the passwordFile can have secure permissions?

[arcnmx]

So this PR doesn't actually improve things... yet!

This is actually a regression, since previously a privileged ExecStartPre was used via "!"

[aanderse]

@arcnmx if you're familiar with LoadCredential and can get to this before @felschr or myself, please feel free. Thanks!

[felschr]

I'm very sorry for messing this up. Thank you so much, @arcnmx, for providing a fix.