The controller reads its credentials from files; every other env-file secret says why

ADR 0086. mesh-controller mounts its six own secrets and names them with
_FILE twins, so no credential of its own reaches its environment. The 35
containers that still read a secret through an env-file carry
secrets-in-environment with the reason; converting each where its software
accepts a path is the per-module work of issue 041.

modules/mesh-controller/module.json

@@ -26,13 +26,6 @@
       "path": "/var/lib/mesh/mesh-controller",
       "mode": "0700"
     },
-    {
-      "id": "control-env",
-      "type": "file",
-      "path": "/var/lib/mesh/mesh-controller/control.env",
-      "mode": "0600",
-      "content": "MESH_STORE_INVENTORY=${secret:inventory}\nMESH_STORE_IDENTITY=${secret:identity}\nMESH_STORE_LICENCES=${secret:licences}\nMESH_BROKER_AMQP=${secret:broker}\nMESH_BROKER_MANAGEMENT=${secret:broker-management}\nMESH_BROKER_ADDRESS=${secret:broker-address}\n"
-    },
     {
       "id": "server",
       "type": "container",
@@ -42,14 +35,23 @@
       "args": [
         "serve"
       ],
-      "env-file": [
-        "/var/lib/mesh/mesh-controller/control.env"
-      ],
       "env": {
-        "MESH_BROKER_CERTIFICATE": "/broker-tls/tls.crt"
+        "MESH_BROKER_CERTIFICATE": "/broker-tls/tls.crt",
+        "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
+        "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
+        "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
+        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
+        "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
+        "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address"
       },
       "volumes": [
-        "mesh-broker-tls:/broker-tls:ro"
+        "mesh-broker-tls:/broker-tls:ro",
+        "/var/lib/mesh/mesh-controller/inventory:/run/secrets/inventory:ro",
+        "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
+        "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
+        "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
+        "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
       ],
       "restart-on": [
         "control-env"