This also adds secrets management for nginx. It is far from perfect (e.g. nginx does not get reloaded when a secret changes).