From bc37e97bfd32ee51ac7d6de38ed77e2aeb6dc1c6 Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sun, 26 Jul 2026 21:06:12 +0900
Subject: [PATCH] nixos/gitea: handle secrets for `email.incoming` config
 section

---
 nixos/modules/services/misc/gitea.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 80f70173bb35b..3a0f637c5ca63 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -369,6 +369,13 @@ in
         description = "Path to a file containing the SMTP password.";
       };
 
+      incomingMailPasswordFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/var/lib/secrets/gitea/incomingmailpw";
+        description = "Path to a file containing the IMAP password.";
+      };
+
       metricsTokenFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -698,6 +705,10 @@ in
           PASSWD = "#mailerpass#";
         };
 
+        "email.incoming" = mkIf (cfg.incomingMailPasswordFile != null) {
+          PASSWORD = "#incomingmailpass#";
+        };
+
         metrics = mkIf (cfg.metricsTokenFile != null) {
           TOKEN = "#metricstoken#";
         };
@@ -858,6 +869,10 @@ in
               ${replaceSecretBin} '#mailerpass#' '${cfg.mailerPasswordFile}' '${runConfig}'
             ''}
 
+            ${lib.optionalString (cfg.incomingMailPasswordFile != null) ''
+              ${replaceSecretBin} '#incomingmailpass#' '${cfg.incomingMailPasswordFile}' '${runConfig}'
+            ''}
+
             ${lib.optionalString (cfg.metricsTokenFile != null) ''
               ${replaceSecretBin} '#metricstoken#' '${cfg.metricsTokenFile}' '${runConfig}'
             ''}