Put unconditional secrets stanza with the other unconditional ones

morph/lib/monitoring.nix

@@ -111,6 +111,14 @@ in {
         permissions = "0400";
         action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
         };
+        "grafana-admin-password" = {
+          source = "${privateKeyPath}/grafana-admin.password";
+          destination = "/run/keys/grafana-admin.password";
+          owner.user = config.systemd.services.grafana.serviceConfig.User;
+          owner.group = config.users.users.grafana.group;
+          permissions = "0400";
+          action = ["sudo" "systemctl" "restart" "grafana.service"];
+        };
       }
       (lib.mkIf (cfg.googleOAuthClientID != "") {
         "grafana-google-sso-secret" = {
@@ -122,16 +130,6 @@ in {
           action = ["sudo" "systemctl" "restart" "grafana.service"];
         };
       })
-      {
-        "grafana-admin-password" = {
-          source = "${privateKeyPath}/grafana-admin.password";
-          destination = "/run/keys/grafana-admin.password";
-          owner.user = config.systemd.services.grafana.serviceConfig.User;
-          owner.group = config.users.users.grafana.group;
-          permissions = "0400";
-          action = ["sudo" "systemctl" "restart" "grafana.service"];
-        };
-      }
       (lib.mkIf cfg.enableSlackAlert {
         "grafana-slack-url" = {
           source = "${privateKeyPath}/grafana-slack-url";