Server/grafana: configure default username and password

roles/server/grafana.nix

@@ -1,11 +1,33 @@
-{config, ...}: let
+{
+  config,
+  flakeSelf,
+  ...
+}: let
   domain = "monitoring.everest.tailscale";
 in {
   users.users.caddy.extraGroups = ["grafana"];
+  age.secrets = let
+    hostSecrets = "${flakeSelf.inputs.secrets}/" + config.networking.hostName + "/";
+  in {
+    grafanaAdminName = {
+      file = hostSecrets + "grafana/admin_name.age";
+      owner = "grafana";
+      group = "grafana";
+    };
+    grafanaAdminPassword= {
+      file = hostSecrets + "grafana/admin_password.age";
+      owner = "grafana";
+      group = "grafana";
+    };
+  };
   services = {
     grafana = {
       enable = true;
       settings = {
+        security = {
+          admin_user = "$__file{${config.age.secrets.grafanaAdminName.path}}";
+          admin_password = "$__file{${config.age.secrets.grafanaAdminPassword.path}}";
+        };
         server = {
           protocol = "socket";
         };