nix/appview: add enviroment file option

nix/modules/appview.nix

···
           default = "00000000000000000000000000000000";
           description = "Cookie secret";
         };
+        environmentFile = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          example = "/etc/tangled-appview.env";
+          description = ''
+            Additional environment file as defined in {manpage}`systemd.exec(5)`.
+
+            Sensitive secrets such as {env}`TANGLED_COOKIE_SECRET` may be
+            passed to the service without makeing them world readable in the
+            nix store.
+
+          '';
+        };
       };
     };
 
···
           ListenStream = "0.0.0.0:${toString cfg.port}";
           ExecStart = "${cfg.package}/bin/appview";
           Restart = "always";
+          EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
         };
 
         environment = {