Why mixing passwords into config files is a security anti‑pattern
Config files should describe behavior, not hold secrets. Bundling passwords, API keys, or tokens with configuration forces rotation and deployment pipelines to tangle, and dozens of NixOS modules illustrate how this creates fragile glue code. Using dedicated channels—environment variables, systemd credentials, or secret managers—keeps lifecycles separate and reduces attack surface.