Separate out the publication config into its own file, so we don't need to deploy all the bot box secrets like twitter api keys on a public web server.