services: zabbix-server: Do not write database password to the store.

* gnu/services/monitoring.scm (zabbix-front-end-config): Read the secret file
from zabbix.conf.php at runtime instead of embedding the contents.

1 files changed, 5 insertions, 6 deletions

diff --git a/gnu/services/monitoring.scm b/gnu/services/monitoring.scm
index 53371614628..1b49dbd3cb7 100644
--- a/gnu/services/monitoring.scm
+++ b/gnu/services/monitoring.scm
@@ -577,7 +577,7 @@ $DB['SERVER']   = '" db-host "';
 $DB['PORT']     = '" (number->string db-port) "';
 $DB['DATABASE'] = '" db-name "';
 $DB['USER']     = '" db-user "';
-$DB['PASSWORD'] = '" (let ((file (location-file %location))
+$DB['PASSWORD'] = " (let ((file (location-file %location))
                            (line (location-line %location))
                            (column (location-column %location)))
                        (if (string-null? db-password)
@@ -592,15 +592,14 @@ $DB['PASSWORD'] = '" (let ((file (location-file %location))
                                        (condition
                                         (&error-location
                                          (location %location)))))
-                               (string-trim-both
-                                (with-input-from-file db-secret-file
-                                  read-string)))
+                               (string-append "trim(file_get_contents('"
+                                              db-secret-file "'));\n"))
                            (begin
                              (display-hint (format #f (G_ "~a:~a:~a: ~a:
 Consider using @code{db-secret-file} instead of @code{db-password} for better
 security.") file line column 'zabbix-front-end-configuration))
-                             db-password))) "';
-
+                             db-password)))
+"
 // Schema name. Used for IBM DB2 and PostgreSQL.
 $DB['SCHEMA'] = '';