Passwords specified here will be world-readable in the Nix store! To pass a password to the service, point the environmentFile option to a file containing HTTP_PASSWORD=<your-password-here> and set this option to <user>:$HTTP_PASSWORD. Note however that this will also locally leak the passwords at runtime via e.g. /proc//cmdline.