pihole.toml is nix-managed read-only so 'pihole setpassword' fails. pihole-FTL reads FTLCONF_* env vars (override the toml) — render an env file from the sops secret pihole_webpassword and feed it via EnvironmentFile. Password stays out of repo/store. VERIFIED in VM: FTLCONF_webserver_api_password -> API login works.