add load_secrets as an explicit stage

during load_config

rather than applying directly to defaults, which should be left static

tests/test_configurer.py

@@ -1,7 +1,9 @@
 """
-Test
+Test configurer
 """
 
+import os
+
 from tljh import configurer
 
 
@@ -161,7 +163,7 @@ def test_auth_github():
     assert c.GitHubOAuthenticator.client_secret == 'something-else'
 
 
-def test_auth_api_default():
+def test_traefik_api_default():
     """
     Test default traefik api authentication settings with no overrides
     """
@@ -171,15 +173,28 @@ def test_auth_api_default():
     assert len(c.TraefikTomlProxy.traefik_api_password) == 0
 
 
-def test_set_auth_api():
+def test_set_traefik_api():
     """
     Test setting per traefik api credentials
     """
     c = apply_mock_config({
-                            'auth_api': {
-                                        'username': 'some_user',
-                                        'password': '1234'
-                            }
+        'traefik_api': {
+            'username': 'some_user',
+            'password': '1234'
+        }
     })
     assert c.TraefikTomlProxy.traefik_api_username == 'some_user'
     assert c.TraefikTomlProxy.traefik_api_password == '1234'
+
+
+def test_load_secrets(tljh_dir):
+    """
+    Test loading secret files
+    """
+    with open(os.path.join(tljh_dir, 'state', 'traefik-api.secret'), 'w') as f:
+        f.write("traefik-password")
+
+    tljh_config = configurer.load_config()
+    assert tljh_config['traefik_api']['password'] == "traefik-password"
+    c = apply_mock_config(tljh_config)
+    assert c.TraefikTomlProxy.traefik_api_password == "traefik-password"