@@ -13,7 +13,7 @@ let
1313 foreground=YES
1414 use=${cfg.use}
1515 login=${cfg.username}
16− password=
16+ password=${lib.optionalString (cfg.protocol == "nsupdate") "/run/${RuntimeDirectory}/ddclient.key"}
1717 protocol=${cfg.protocol}
1818 ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
1919 ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
@@ -29,8 +29,10 @@ let
2929 configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
3030
3131 preStart = ''
32− install ${configFile} /run/${RuntimeDirectory}/ddclient.conf
33− ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
32+ install --owner ddclient -m600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
33+ ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
34+ install --owner ddclient -m600 ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
35+ '' else if (cfg.passwordFile != null) then ''
3436 password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
3537 sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf
3638 '' else ''
@@ -85,7 +87,9 @@ with lib;
8587 };
8688
8789 username = mkOption {
88− default = "";
90+ # For `nsupdate` username contains the path to the nsupdate executable
91+ default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
92+ defaultText = "";
8993 type = str;
9094 description = ''
9195 User name.
@@ -96,7 +100,7 @@ with lib;
96100 default = null;
97101 type = nullOr str;
98102 description = ''
99− A file containing the password.
103+ A file containing the password or a TSIG key in named format when using the nsupdate protocol.
100104 '';
101105 };
102106