move external-keys to _config.yml