Credentials must never be stored in the NixOS configuration or the Nix store. The Nix store is world-readable — any value embedded in a .nix file or interpolated into a derivation is visible to all users on the system.

All secrets (API tokens, auth keys) are:

1. Stored on disk in files with restrictive permissions (mode 600)
2. Loaded at runtime by services via EnvironmentFile or tokenFile config options
3. Referenced by path in config (e.g. tokenFile = "/var/lib/clawpi/telegram-bot-token")

The config only contains the path to the secret file, never the secret value itself.

Use the scripts in scripts/ to write secrets to the Pi:

# BAD: Token in the Nix store (world-readable!)
channels.telegram.tokenFile = "123456789:ABCdef...";  # this is the token, not a file path!

# GOOD: Path to a file containing the token
channels.telegram.tokenFile = "/var/lib/clawpi/telegram-bot-token";