go-neb's secretFile support changes the semantics of the template options

[grahamc]

Describe the bug

The syntax inside templates is different depending on if secretFile is used or not, this makes the templates non-portable and produces confusing results.

For example, without a secret file the template in this config is valid:

{
  services.go-neb = {
    config = {
      clients = [
        {
          UserId = "@bot:nixos.org";
          AccessToken = "SomeAccessToken";
          HomeServerUrl = "https://nixos.ems.host";
          Sync = true;
          AutoJoinRooms = true;
          DisplayName = "Bot";
        }
      ];
      services = [
        {
          ID = "alertmanager_service";
          Type = "alertmanager";
          UserId = "@bot:nixos.org";
          Config.rooms."!QLQqibtFaVtDgurUAE:nixos.org" = {
            html_template = ''
              {{range .Alerts -}}
                {{ $severity := index .Labels "severity" }}
                <b>{{ $severity }}</b>
              {{end -}}
            '';
            msg_type = "m.text";
          };
        }
      ];
    };
  };
}

However, after adding a secretFile we get startup errors:

html template is invalid: template: htmlTemplate:2: unexpected \":=\" in command"

What is happening? In the rendered config, $severity has been replaced with an empty string:

html_template: "{{range .Alerts -}}\n  {{  := index .Labels \"severity\"\...

To fix this, I must change $severity to $$severity. However, $$severity is not valid if I don't specify a secretFile.

Expected behavior

The templates I provide should be valid whether or not I provide a secretFile.

Notify maintainers

cc @Mic92, @mweinelt

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

• system: "x86_64-linux"
• host os: Linux 5.10.84, NixOS, 21.11 (Porcupine)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.4pre20210810_a6ba313
• nixpkgs: /nix/store/33zzxrj3kzlyv22qm3p7a703dp69cshd-source

Maintainer information:

# a list of nixpkgs attributes affected by the problem
attribute:
# a list of nixos modules affected by the problem
module:
- services.go-neb

[lheckemann]

Similar to #126083. Any chance that go-neb supports secret files itself so it can be fixed like prometheus was in #144984?

[grahamc]

It doesn't today but I suppose it surely could :).

[Mic92]

Does envsubst not ignore unknown variables?