This is the same logic as the common module, but for secrets that don't need to be shared to different hosts.
This will be more consistent in the future if I want to introduce darwin or home-manager configurations.