[service_user."plume"] password_secret = "plume/pgsql_pw" [secrets."plume/secret_key"] type = 'command' rotate = true command = 'openssl rand -base64 32'