Note that secrets.yml is overwritten at deploy-time