wrap env pusher secret with erb