Currently all settings are read from config.yaml as is. As documented in the config file design, we want to allow sensitive values to be read from environment variables, instead of needing to be written down and commited in config.yaml.

Unsure if we want this to only be for credential settings, or allow overrides for any setting from an envvar (this might be impossible without restructuring how we parse stuff to allow defaults for all values).

I see two ways to do this:

• "silent" overrides where the target setting is parsed from the envvar name:

registry:
  build: 
    user:  # --> REGISTRY_BUILD_USER
    pass:  # --> REGISTRY_BUILD_PASS
  cluster:
    user:  # --> REGISTRY_CLUSTER_USER
    pass:  # --> REGISTRY_CLUSTER_USER

• explicit envvar name set in the config

registry:
  build: 
    user:  
      from_env: REGISTRY_BUILD_USER
    pass: 
      from_env: REGISTRY_BUILD_PASS

The latter might be easier to do with the way Serde wants to parse stuff.