Secrets in (generated) configs. How to deal with them?

[raingloom]

Hi all!

I'm trying to package Yggdrasil as a Guix service and I took a look at
what NixOS does and they actually don't simply generate the config in
the store, instead it's combined with another input of the service and
the combined JSON is fed to Yggdrasil on stdin.

Is this how I should do it as well? Or maybe the Guix store can make
some outputs private?