
Rather than using openssl to hash the password at build time, and hence leaving the plaintext password world-readable in the nix store, we can instead hash the password in the nix expression itself using builtins.hashString.
Rather than using openssl to hash the password at build time, and hence leaving the plaintext password world-readable in the nix store, we can instead hash the password in the nix expression itself using builtins.hashString.