yopass-server settings, passed as environment variables. Every flag in the upstream documentation has an environment variable form (--oidc-issuer is OIDC_ISSUER); use that name as the attribute. Booleans become true/false, numbers are stringified and lists are joined with commas. Anything left unset keeps yopass-server’s own default, except that the module binds ADDRESS to 127.0.0.1 (expecting a reverse proxy in front) and points FILE_STORE_PATH at /var/lib/yopass/files so uploads survive restarts; both can be overridden here. A FILE_STORE_PATH outside /var/lib/yopass is allow-listed for writing automatically, but it must already exist and be writable by the service, which runs as a dynamic user. The module doesn’t own the storage backend. With DATABASE = "redis" pointing at a local services.redis.servers.<name>, add systemd.services.yopass.after = [ "redis-<name>.service" ]; yourself to avoid a startup race; the memcached unit name is fixed, so that ordering is handled for you. Secrets belong in services.yopass.environmentFile rather than here, since this ends up in the Nix store.

{ }

{
  DATABASE = "redis";
  MAX_FILE_SIZE = "10MB";
  PORT = 8080;
  REDIS = "redis://127.0.0.1:6379/0";
  TRUSTED_PROXIES = [
    "192.168.1.0/24"
    "10.0.0.0/8"
  ];
}