move secrets/settings to a separate config/ dir