YAML for bootstrap config; put secrets in Facter