services: move all secrets into /media/secrets

moves all secrets into one centralised location in
/media/secrets and uses systemd-tmpfiles to set the
appropriate permissions for them

modules/services/uptime-kuma.nix

@@ -9,6 +9,15 @@
     };
   };
 
+  systemd.tmpfiles.rules = [
+    "d /media/secrets/uptime-kuma 0700 root root"
+  ];
+  
+  fileSystems."/var/lib/private/uptime-kuma" = {
+    device = "/media/apps/uptime-kuma";
+    options = [ "bind" ];
+  };
+
   services.caddy.virtualHosts."status.${config.homelab.domain}" = {
     useACMEHost = config.homelab.domain;
     extraConfig = ''