From a099f7008b75490ca8dcf569f404777b94a7b2e0 Mon Sep 17 00:00:00 2001
From: Mathijs Kwik <mathijs@bluescreen303.nl>
Date: Tue, 2 Jul 2013 06:03:52 +0200
Subject: [PATCH] provide a warning on password options that do not follow the
 read-from-file convention.

---
 modules/programs/ssmtp.nix           | 2 +-
 modules/services/databases/redis.nix | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/modules/programs/ssmtp.nix b/modules/programs/ssmtp.nix
index d8a324190f6..f61d14c2046 100644
--- a/modules/programs/ssmtp.nix
+++ b/modules/programs/ssmtp.nix
@@ -75,7 +75,7 @@ let
         default = "";
         example = "correctHorseBatteryStaple";
         description = "
-          Password used for SMTP auth.
+          Password used for SMTP auth. (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
         ";
       };
 
diff --git a/modules/services/databases/redis.nix b/modules/services/databases/redis.nix
index 9472136e17e..5bc58c73bd6 100644
--- a/modules/services/databases/redis.nix
+++ b/modules/services/databases/redis.nix
@@ -122,12 +122,13 @@ in
         default = null;
         description = ''If the master is password protected (using the requirePass configuration)
         it is possible to tell the slave to authenticate before starting the replication synchronization
-        process, otherwise the master will refuse the slave request.'';
+        process, otherwise the master will refuse the slave request.
+        (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
       };
 
       requirePass = mkOption {
         default = null;
-        description = "Password for database";
+        description = "Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)";
         example = "letmein!";
       };