How to inject a secret into the environment via a systemd service definition?

Hi XIII ! Another option is to write the secret into a private temp file and read it from there into your app. This is secure because systemd creates private temp files in a separate application-specific namespace. In fact by some accounts it's even more secure than environment variables, which can be queried pretty easily from other processes!

My suggestion would look like:

[Service]
ExecStartPre=/path/to/op read op://Vault/Item/password >/tmp/item
ExecStart=/some/app # reads file /tmp/item contents into memory as password
PrivateTmp=yes # Enforces creating /tmp/* in private namespace for the service