refactor key fetch
upload secrets when using deploy()
LICENSE
add Makefile
ignore passwd secrets
initial "good enough"