feat: add utility functions

systems/etna/default.nix

@@ -1,41 +1,34 @@
 {
   lib,
+  pkgs,
   config,
-  pkgs, # required for fudgeMyShitIn
+  _utils,
   ...
-} @ args: let
+}: let
   tunnelId = "57f51ad7-25a0-45f3-b113-0b6ae0b2c3e5";
 
-  secretsPath = ../../secrets/etna;
-  mkSecrets = builtins.mapAttrs (name: value: value // {file = "${secretsPath}/${name}.age";});
-  mkSecret = name: other: mkSecrets {${name} = other;};
-
-  fudgeMyShitIn = builtins.map (file: import file (args // {inherit mkSecret mkSecrets;}));
-in {
-  imports =
-    [
-      (lib.mkAliasOptionModule ["cfTunnels"] ["services" "cloudflared" "tunnels" tunnelId "ingress"])
-    ]
-    ++ fudgeMyShitIn [
-      ./minecraft.nix
-      ./dendrite.nix
-      ./nextcloud.nix
-      ./reposilite.nix
-      ./uku.nix
-      ./vaultwarden.nix
-      ./forgejo.nix
-      ./shlink.nix
-      ./metrics.nix
-    ];
-
-  age.secrets = mkSecrets {
-    tunnelCreds = {
-      owner = "cloudflared";
-      group = "cloudflared";
-    };
-
-    frpToken = {};
+  frpSecret = _utils.setupSingleSecret config "frpToken" {};
+  cfTunnelSecret = _utils.setupSingleSecret config "tunnelCreds" {
+    owner = "cloudflared";
+    group = "cloudflared";
   };
+in {
+  imports = [
+    (lib.mkAliasOptionModule ["cfTunnels"] ["services" "cloudflared" "tunnels" tunnelId "ingress"])
+
+    frpSecret.generate
+    cfTunnelSecret.generate
+
+    ./minecraft.nix
+    ./dendrite.nix
+    ./nextcloud.nix
+    ./reposilite.nix
+    ./uku.nix
+    ./vaultwarden.nix
+    ./forgejo.nix
+    ./shlink.nix
+    ./metrics.nix
+  ];
 
   boot = {
     kernelPackages = lib.mkForce pkgs.linuxPackages_6_1;
@@ -68,11 +61,11 @@ in {
     cloudflared = {
       enable = true;
       tunnels.${tunnelId} = {
-        credentialsFile = config.age.secrets.tunnelCreds.path;
+        credentialsFile = cfTunnelSecret.path;
         default = "http_status:404";
       };
     };
   };
 
-  systemd.services.frp.serviceConfig.EnvironmentFile = config.age.secrets.frpToken.path;
+  systemd.services.frp.serviceConfig.EnvironmentFile = frpSecret.path;
 }