remove agenix and migrate secrets to clan vars

squash this

machines/genepi/freshrss.nix

@@ -4,23 +4,26 @@ let
   subdomain = "rss.${domain}";
 in
 {
-  age.secrets.freshrss = {
-    file = ../../secrets/freshrss.age;
-    mode = "700";
-    owner = config.services.freshrss.user;
-  };
-
   services.freshrss = {
     enable = true;
     baseUrl = "https://${subdomain}";
     virtualHost = "${subdomain}";
 
     defaultUser = "rpqt";
-    passwordFile = config.age.secrets.freshrss.path;
+    passwordFile = config.clan.core.vars.generators.freshrss.files.freshrss-password.path;
   };
 
   services.nginx.virtualHosts.${config.services.freshrss.virtualHost} = {
     forceSSL = true;
     useACMEHost = "${domain}";
   };
+
+  clan.core.vars.generators.freshrss = {
+    prompts.freshrss-password = {
+      description = "freshrss default user password";
+      type = "hidden";
+      persist = true;
+    };
+    files.freshrss-password.owner = config.services.freshrss.user;
+  };
 }