services: cloudflare-tunnel: Support token file.

* modules/rosenthal/services/child-error.scm
(cloudflare-tunnel-configuration)[token-file]: New field.
(cloudflare-tunnel-shepherd-service): Adjust accordingly.

modules/rosenthal/packages/networking.scm

@@ -15,7 +15,7 @@
 (define-public cloudflared
   (package
     (name "cloudflared")
-    (version "2025.4.0")
+    (version "2025.4.2")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -27,7 +27,7 @@
               ;; (snippet '(delete-file-recursively "vendor"))
               (sha256
                (base32
-                "03bhkd5cgrw2srgh82xv1y95zkpx4v2rqdy9azhv4y7fzz07p89w"))))
+                "0mblq1zvl7722k3515yc99ym18li39anlcmj8s10m7kkp9yfc596"))))
     (build-system go-build-system)
     (arguments
      (list #:go go-1.23

modules/rosenthal/services/child-error.scm

@@ -127,6 +127,8 @@
 ;;
 
 
+(define-maybe string)
+
 (define-configuration cloudflare-tunnel-configuration
   (cloudflared
    (file-like cloudflared)
@@ -148,8 +150,11 @@ headers.  This can expose sensitive information in your logs.")
 
   ;; Subcommand options
   (token
-   (string "")
+   maybe-string
    "The Tunnel token.")
+  (token-file
+   maybe-string
+   "Secert file for the Tunnel token.")
   (extra-options
    (list-of-strings '())
    "List of extra options.")
@@ -158,7 +163,7 @@ headers.  This can expose sensitive information in your logs.")
 (define cloudflare-tunnel-shepherd-service
   (match-record-lambda <cloudflare-tunnel-configuration>
       (cloudflared log-level log-file extra-tunnel-options
-                   token extra-options)
+                   token token-file extra-options)
     (list (shepherd-service
            (documentation "Run cloudflared.")
            (provision '(cloudflare-tunnel))
@@ -175,7 +180,14 @@ headers.  This can expose sensitive information in your logs.")
                      #:group "nogroup"
                      #:log-file #$log-file
                      #:environment-variables
-                     (list (format #f "TUNNEL_TOKEN=~a" #$token))))
+                     (list #$@(if (maybe-value-set? token)
+                                  (list (format #f "TUNNEL_TOKEN=~a"
+                                                token))
+                                  '())
+                           #$@(if (maybe-value-set? token-file)
+                                  (list (format #f "TUNNEL_TOKEN_FILE=~a"
+                                                token-file))
+                                  '()))))
            (stop #~(make-kill-destructor))))))
 
 (define cloudflare-tunnel-service-type