From 771c76294a42a4b53c0966b0b0fd1470c770ddc2 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 30 Jun 2023 11:45:59 +0200
Subject: [PATCH] man: document how credentials are passed into generators

---
 man/systemd.generator.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/man/systemd.generator.xml b/man/systemd.generator.xml
index 5e39c5877fd..7b2501aa776 100644
--- a/man/systemd.generator.xml
+++ b/man/systemd.generator.xml
@@ -190,6 +190,20 @@
         <varname>ConditionArchitecture=</varname> in
         <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>$CREDENTIALS_DIRECTORY</varname></term>
+        <term><varname>$ENCRYPTED_CREDENTIALS_DIRECTORY</varname></term>
+
+        <listitem><para>If set, refers to the directory system credentials have been placed in. Credentials
+        passed into the system in plaintext form will be placed in <varname>$CREDENTIALS_DIRECTORY</varname>,
+        and those passed in in encrypted form will be placed in
+        <varname>$ENCRYPTED_CREDENTIALS_DIRECTORY</varname>. Use the
+        <citerefentry><refentrytitle>systemd-creds</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+        command to automatically decrypt/authenticate credentials passed in, if needed. Specifically, use the
+        <command>systemd-creds --system cat</command> command.</para></listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 
-- 
2.47.3