services.plausible.adminUser.passwordHashFile

Path to a file containing the bcrypt hash of the seeded admin user's password (see services.plausible.adminUser.email).

Using a hash file (rather than the plaintext password) means the plaintext never has to be stored on disk or in the Nix store. Generate a hash e.g. with mkpasswd -m bcrypt (the resulting $2b$... string).

This file is read via systemd's LoadCredential, so it does not enter the Nix store.