Comment by packetlost

Something like pa should be easy enough to port to it as a first pass: https://github.com/biox/pa

IMO Vault is really nice, but something as simple as possible is better for managing secrets, especially when the storage layer has permission and sane encryption handled for you.