# secrets are escrowed separately (bastion ~/.backup-escrow, crystalcave ~/.hermes/secrets/yes); never copied to B2
/etc/yes-site/secrets.env
/etc/yes-site/tunnel.token
