The controller's own manifest reads its credentials from files too

The mesh-controller repository carries the manifest the mesh builds the
controller from; the catalogue's copy is what genesis registers. The two must
say the same thing, and the first rebuild from source proved they did not.

module.json

@@ -19,6 +19,7 @@
     "broker-management": "/var/lib/mesh/mesh-controller/broker-management",
     "broker-address": "/var/lib/mesh/mesh-controller/broker-address"
   },
+  "secrets-owner": "65534:65534",
   "resources": [
     {
       "id": "mesh-state",
@@ -26,13 +27,6 @@
       "path": "/var/lib/mesh/mesh-controller",
       "mode": "0700"
     },
-    {
-      "id": "control-env",
-      "type": "file",
-      "path": "/var/lib/mesh/mesh-controller/control.env",
-      "mode": "0600",
-      "content": "MESH_STORE_INVENTORY=${secret:inventory}\nMESH_STORE_IDENTITY=${secret:identity}\nMESH_STORE_LICENCES=${secret:licences}\nMESH_BROKER_AMQP=${secret:broker}\nMESH_BROKER_MANAGEMENT=${secret:broker-management}\nMESH_BROKER_ADDRESS=${secret:broker-address}\n"
-    },
     {
       "id": "server",
       "type": "container",
@@ -41,19 +35,28 @@
       "args": [
         "serve"
       ],
-      "env-file": [
-        "/var/lib/mesh/mesh-controller/control.env"
-      ],
       "env": {
-        "MESH_BROKER_CERTIFICATE": "/broker-tls/tls.crt"
+        "MESH_BROKER_CERTIFICATE": "/broker-tls/tls.crt",
+        "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
+        "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
+        "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
+        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
+        "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
+        "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address"
       },
       "volumes": [
-        "mesh-broker-tls:/broker-tls:ro"
+        "mesh-broker-tls:/broker-tls:ro",
+        "/var/lib/mesh/mesh-controller/inventory:/run/secrets/inventory:ro",
+        "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
+        "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
+        "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
+        "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
       ],
+      "artifact": "server",
       "restart-on": [
         "control-env"
-      ],
-      "artifact": "server"
+      ]
     }
   ],
   "build": {