move secret keys to secrets.yml and env vars