extract cfg to secrets.yml