clanService/grafana: add requred attr

modules/clan/grafana/default.nix

@@ -13,11 +13,28 @@
       {
         config,
         lib,
+        pkgs,
         ...
       }:
       {
+        clan.core.vars.generators.grafana = {
+          files = {
+            secret_key = {
+              owner = "grafana";
+              group = "grafana";
+              secret = true;
+            };
+          };
+          script = ''
+            openssl rand -hex 32 > "$out"/secret_key
+          '';
+          runtimeInputs = [
+            pkgs.openssl
+          ];
+        };
         services.grafana = {
           enable = lib.mkDefault true;
+          settings.security.secret_key = "$__file{${config.clan.core.vars.generators.grafana.files.secret_key.path}}";
         };
 
         clan.core.state.grafana.folders = [ config.services.grafana.dataDir ];