add support for secrets

The vault password is `sekrit`, and it only has a placeholder in it.  We
will re-key to a shared password before adding real secrets.