secrets

Occurred to me that breaking out secrets would result in a shitload of sample.secret.blah.yaml files, and that would make for a lot of noise in the filesystem. Maybe just keep it all in one.