host     api.ganymede.northrook.com
scope    api   (first label, as HostScopeResolver::byLabel)
install  /srv/vault
runs as  site-vault
own var  secret of vault

fwrk's   unreadable (good)