provide a warning on password options that do not follow the read-from-file convention.

1 files changed, 3 insertions, 2 deletions

diff --git a/modules/services/databases/redis.nix b/modules/services/databases/redis.nix
index 9472136e17e..5bc58c73bd6 100644
--- a/modules/services/databases/redis.nix
+++ b/modules/services/databases/redis.nix
@@ -122,12 +122,13 @@ in
         default = null;
         description = ''If the master is password protected (using the requirePass configuration)
         it is possible to tell the slave to authenticate before starting the replication synchronization
-        process, otherwise the master will refuse the slave request.'';
+        process, otherwise the master will refuse the slave request.
+        (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
       };
 
       requirePass = mkOption {
         default = null;
-        description = "Password for database";
+        description = "Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)";
         example = "letmein!";
       };