need erb to get env vars from secrets.yml