secrets as environment variables. closes #5