moving secrets yml to a cap symlink task so we can store actual secrets