Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

gitea, umami, influxdb, icecast and mailu require a secret and keep each of theirs
under a local name (novox/hq ADR 0094); the broker account stays their own. The
route proxy's recipe starts FROM the bases its manifest declares (ADR 0097).

modules/icecast/module.json

@@ -9,9 +9,6 @@
     "module.icecast.stream.stopped"
   ],
   "own-secrets": {
-    "source": "/var/lib/icecast-module/source.secret",
-    "admin": "/var/lib/icecast-module/admin.secret",
-    "relay": "/var/lib/icecast-module/relay.secret",
     "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
@@ -103,5 +100,15 @@
         "from": "Dockerfile"
       }
     ]
+  },
+  "requires": [
+    "secret"
+  ],
+  "secrets": {
+    "secret": {
+      "source": "/var/lib/icecast-module/source.secret",
+      "admin": "/var/lib/icecast-module/admin.secret",
+      "relay": "/var/lib/icecast-module/relay.secret"
+    }
   }
 }