migrate to secrets.yml from dotenv