I was poking around the ifstate module a little because I wondered how password files are solved for ifstate in NixOS found this

sed -i $'s|\'!include |!include \'|' $out

ifstate is using the yaml tag !include to specify if a string is used as a password or as a file containig a password. The NixOS module ist using toJSON and replacing every string startig with !include.

This feels very sketchy to me. Is there a better way to solve this in NixOS or is this state of the art?

https://github.com/NixOS/nixpkgs/blob/c23193b943c6c689d70ee98ce3128239ed9e32d1/nixos/modules/services/networking/ifstate.nix#L29

        sed -i -e "s/'\!\([a-z_]\+\) \(.*\)'/\!\1 \2/;s/^\!\!/\!/;" $out