The cache-server subcommand only checks the literal external_secret field at startup and errors out if just external_secret_file is set (unlike the daemon, which handles _file fine). Move its config out of git entirely - it now has to hold the actual secret value - generated straight into .data on the VPS instead.