generate-secrets.sh will also be used in generate-secrets.nix, so DRY its dependency definitions.
Move pkg definitions to pkgs/default.nix. This allows us to just import the pkgs in overlay.nix and get rid of the filtering to exclude the modules.