Consider switching to LoadCredentials to inject secrets

[Mic92]

systemd allows to specify unix sockets for LoadCredentials, which would allow to only start a single vault agent + wrapper binary to serve all nixos services with secrets: systemd/systemd#16568
Systemd also take care of the chowning. Then it would be not longer needed to use this complex sidecar service logic.

[giodamelio]

numtide has done just that: https://github.com/numtide/systemd-vaultd

There are even some nix modules in there, though they are not documented, so not sure how stable they will be.

[Mic92]

We have them in use for a while to overcome reliability issues of nixos-vault-service. We do not have plans to change them in a non-backwards compatible way.