looks like we need all of these paths to be `{{ secure_dir }}/vars/...`, or else we should change how `secure_dir` is structured.