move gandalf config to secrets