use environment variables in secrets.yml