From 9d5dba717041400aececbb86b46896cd18d8b84d Mon Sep 17 00:00:00 2001
From: Andreas Brinner <andreas@everlanes.net>
Date: Sun, 23 Apr 2023 20:28:00 +0200
Subject: [PATCH] nixos/roundcube: read only first line of password file

Only read the first line of the password file, if has multiple lines.
Mention that behaviour in options documentation.
---
 nixos/modules/services/mail/roundcube.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index ecf4d3ebc4d8..b9cf526b0bbe 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -73,7 +73,8 @@ in
         description = lib.mdDoc ''
           Password file for the postgresql connection.
           Must be formated according to PostgreSQL .pgpass standard (see https://www.postgresql.org/docs/current/libpq-pgpass.html)
-          and readable by user `nginx`. Ignored if `database.host` is set to `localhost`, as peer authentication will be used.
+          but only one line, no comments and readable by user `nginx`.
+          Ignored if `database.host` is set to `localhost`, as peer authentication will be used.
         '';
       };
       dbname = mkOption {
@@ -128,7 +129,7 @@ in
       <?php
 
       ${lib.optionalString (!localDB) ''
-        $password = file_get_contents('${cfg.database.passwordFile}');
+        $password = file('${cfg.database.passwordFile}')[0];
         $password = preg_split('~\\\\.(*SKIP)(*FAIL)|\:~s', $password);
         $password = end($password);
         $password = str_replace("\\:", ":", $password);