generate-secrets: always run with Bash, stop on errors

pkgs/generate-secrets/default.nix

@@ -9,7 +9,7 @@ let
     exec ${pkgs.python3}/bin/python ${rpcauthSrc} "$@"
   '';
 in
-writeScript "generate-secrets" ''
+writers.writeBash "generate-secrets" ''
   export PATH=${lib.makeBinPath [ coreutils apg openssl gnugrep rpcauth ]}
   . ${./generate-secrets.sh} ${./openssl.cnf}
 ''

pkgs/generate-secrets/generate-secrets.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 opensslConf=${1:-openssl.cnf}
 
 makePasswordSecret() {