Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the environmentFile option to a file containing PROXY_PASSWORD=<your-password-here> and set this option to <user>:$PROXY_PASSWORD@<host>:<port>. Note however that this will also locally leak the passwords at runtime via e.g. /proc//cmdline.