tidy up wallabag

hosts/profiles/wallabag/default.nix

@@ -1,6 +1,15 @@
 { pkgs, config, lib, ... }:
 
+let
+  wallabag-password = builtins.readFile "/run/agenix/wallabag_password";
+  wallabag-secret = builtins.readFile "/run/agenix/wallabag_secret";
+in
 {
+  age.secrets.wallabag-password.file = "/run/agenix/wallabag_password";
+  age.secrets.wallabag-password.owner = "wallabag";
+  age.secrets.wallabag-secret.file = "/run/agenix/wallabag_secret";
+  age.secrets.wallabag-secret.owner = "wallabag";
+
   services.postgresql = {
     enable = true;
     package = pkgs.postgresql_11;
@@ -28,7 +37,7 @@
           database_name: wallabag
           database_user: wallabag
           # TODO agenix
-          database_password: wallabag 
+          database_password: ${wallabag-password}
           # For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
           database_path: ~
           database_table_prefix: wallabag_
@@ -51,7 +60,7 @@
 
           # A secret key that's used to generate certain security-related tokens
           # TODO agenix
-          secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
+          secret: ${wallabag-secret} SAFGOECRIlfal89oe6u0(*^dsaaih961
 
           # two factor stuff
           twofactor_auth: true

secrets/wallabag-password.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 K2vF/Q 71YyNzHijmSYXrZM9XCpTuz+5pp5xelrfrsDALqEqWg
+hukblsPnp+yj9O5y3YU4NT2PLxp0WGtsEuOZlxx06OI
+-> J#cy5AG-grease 9'>
+YNU2IHnG1ELEEKThpSVN357BDExcNcV5npG7P/J0/jBJYofo47p3
+--- L807Hrt3wcqdJI7s9VOWIvJ4MsFcoylXUBMiMwIrJb8
+j½âj`Ëþ‰P–;Ê-$
ž<>ìör‚pÎLàA÷j£Elï{‹ðH{›

secrets/wallabag-secret.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 K2vF/Q rJ+Bv933siTbr1bFbjS8yZFAJNJVFHGSaTRKL5voKEY
+XLVaUEDtOSHciozDfqVc6tpYi1tGpu9p+lR6lv5R1Pc
+-> <$ra')-grease
+d6H6lDsqhGnmRjyAJzzpcb1z4azaZ0CSzS24o1OMDt+wo+PIp5bQ/xgsD2HEOveB
+n2A/GSyDv3Bv
+--- jWBWzIifCy4DUMo18Oi/HflStwhxABHgrx1LsAdryFE
+^KQZÔû9ªÿB‰OàщpÜù#…JL‡ÅZ¡Ý	%?Q×\³˜iüófÒbŽ‡Þ˸_²4‚Íz'„ÕP