diff --git a/defaults.yaml b/defaults.yaml
new file mode 100644
index 0000000..c9e2989
--- /dev/null
+++ b/defaults.yaml
@@ -0,0 +1,138 @@
+annex::vhost::basic_auth_content: annex::vhost::basic_auth_content
+basic_auth_content: basic_auth_content
+basic_auth_deposit_content: basic_auth_deposit_content
+ceph::secrets::admin: ceph::secrets::admin
+ceph::secrets::bootstrap_osd: ceph::secrets::bootstrap_osd
+ceph::secrets::mgr: ceph::secrets::mgr
+ceph::secrets::mon: ceph::secrets::mon
+ceph::secrets::proxmox_rbd: ceph::secrets::proxmox_rbd
+ceph::secrets::swh_contents: ceph::secrets::swh_contents
+ceph::secrets::swh_contents_rw: ceph::secrets::swh_contents_rw
+ceph::secrets::swh_contents_test: ceph::secrets::swh_contents_test
+ceph::secrets::swh_contents_test_rw: ceph::secrets::swh_contents_test_rw
+deposit_basic_auth_swhworker_password: deposit_basic_auth_swhworker_password
+deposit_basic_auth_swhworker_username: deposit_basic_auth_swhworker_username
+grafana::db::password: grafana::db::password
+grafana::passwords: {admin: 'grafana::passwords/admin', anonymous: 'grafana::passwords/anonymous'}
+icinga2::apiusers:
+  root: {password: 'icinga2::apiusers/root/password'}
+icinga2::icingaweb2::db::password: icinga2::icingaweb2::db::password
+icinga2::master::db::password: icinga2::master::db::password
+mediawiki::vhosts:
+  intranet.softwareheritage.org:
+    basic_auth_content: mediawiki::vhosts/intranet.softwareheritage.org/basic_auth_content
+    icinga_http_auth_pair: mediawiki::vhosts/intranet.softwareheritage.org/icinga_http_auth_pair
+    mysql: {password: 'mediawiki::vhosts/intranet.softwareheritage.org/mysql/password'}
+    secret_key: mediawiki::vhosts/intranet.softwareheritage.org/secret_key
+    upgrade_key: mediawiki::vhosts/intranet.softwareheritage.org/upgrade_key
+  wiki.softwareheritage.org:
+    basic_auth_content: mediawiki::vhosts/wiki.softwareheritage.org/basic_auth_content
+    mysql: {password: 'mediawiki::vhosts/wiki.softwareheritage.org/mysql/password'}
+    secret_key: mediawiki::vhosts/wiki.softwareheritage.org/secret_key
+    upgrade_key: mediawiki::vhosts/wiki.softwareheritage.org/upgrade_key
+phabricator::mysql::password: phabricator::mysql::password
+phabricator::mysql::root_password: phabricator::mysql::root_password
+phabricator::vhost::basic_auth_content: phabricator::vhost::basic_auth_content
+rabbitmq::monitoring::password: rabbitmq::monitoring::password
+redis::server::password: redis::server::password
+ssl:
+  star_internal_softwareheritage_org: {private_key: ssl/star_internal_softwareheritage_org/private_key}
+  star_softwareheritage_org: {private_key: ssl/star_softwareheritage_org/private_key}
+  stats_export_softwareheritage_org: {private_key: ssl/stats_export_softwareheritage_org/private_key}
+swh::azure::credentials::0euwestswh: swh::azure::credentials::0euwestswh
+swh::azure::credentials::1euwestswh: swh::azure::credentials::1euwestswh
+swh::azure::credentials::2euwestswh: swh::azure::credentials::2euwestswh
+swh::azure::credentials::3euwestswh: swh::azure::credentials::3euwestswh
+swh::azure::credentials::4euwestswh: swh::azure::credentials::4euwestswh
+swh::azure::credentials::5euwestswh: swh::azure::credentials::5euwestswh
+swh::azure::credentials::6euwestswh: swh::azure::credentials::6euwestswh
+swh::azure::credentials::7euwestswh: swh::azure::credentials::7euwestswh
+swh::azure::credentials::8euwestswh: swh::azure::credentials::8euwestswh
+swh::azure::credentials::9euwestswh: swh::azure::credentials::9euwestswh
+swh::azure::credentials::aeuwestswh: swh::azure::credentials::aeuwestswh
+swh::azure::credentials::beuwestswh: swh::azure::credentials::beuwestswh
+swh::azure::credentials::ceuwestswh: swh::azure::credentials::ceuwestswh
+swh::azure::credentials::deuwestswh: swh::azure::credentials::deuwestswh
+swh::azure::credentials::eeuwestswh: swh::azure::credentials::eeuwestswh
+swh::azure::credentials::feuwestswh: swh::azure::credentials::feuwestswh
+swh::deploy::deposit::runtime_secret_key: swh::deploy::deposit::runtime_secret_key
+swh::deploy::deposit::vhost::basic_auth_content: swh::deploy::deposit::vhost::basic_auth_content
+swh::deploy::indexer::storage::db::password: swh::deploy::indexer::storage::db::password
+swh::deploy::loader_debian::db::password: swh::deploy::loader_debian::db::password
+swh::deploy::private_key: swh::deploy::private_key
+swh::deploy::scheduler::db::password: swh::deploy::scheduler::db::password
+swh::deploy::scheduler::task_broker::password: swh::deploy::scheduler::task_broker::password
+swh::deploy::scheduler::updater::backend::db::password: swh::deploy::scheduler::updater::backend::db::password
+swh::deploy::scheduler::updater::consumer::ghtorrent::password: swh::deploy::scheduler::updater::consumer::ghtorrent::password
+swh::deploy::scheduler::updater::consumer::ghtorrent::private_key: swh::deploy::scheduler::updater::consumer::ghtorrent::private_key
+swh::deploy::storage::db::password: swh::deploy::storage::db::password
+swh::deploy::vault::db::password: swh::deploy::vault::db::password
+swh::deploy::webapp::conf::secret_key: swh::deploy::webapp::conf::secret_key
+swh::deploy::webapp::config::grecaptcha::private_key: swh::deploy::webapp::config::grecaptcha::private_key
+swh::deploy::webapp::vhost::basic_auth_content: swh::deploy::webapp::vhost::basic_auth_content
+swh::deploy::worker::swh_lister_github::config:
+  credentials:
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/0/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/0/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/1/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/1/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/2/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/2/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/3/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/3/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/4/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/4/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/5/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/5/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/6/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/6/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/7/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/7/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/8/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/8/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/9/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/9/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/10/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/10/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/11/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/11/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/12/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/12/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/13/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/13/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/14/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/14/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/15/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/15/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/16/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/16/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/17/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/17/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/18/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/18/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/19/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/19/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/20/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/20/username'}
+  - {password: 'swh::deploy::worker::swh_lister_github::config/credentials/21/password',
+    username: 'swh::deploy::worker::swh_lister_github::config/credentials/21/username'}
+swh::deploy::worker::swh_lister_github::db::password: swh::deploy::worker::swh_lister_github::db::password
+swh::deploy::worker::swh_lister_gitlab::config:
+  credentials:
+    gitlab:
+    - {password: 'swh::deploy::worker::swh_lister_gitlab::config/credentials/gitlab/0/password',
+      username: 'swh::deploy::worker::swh_lister_gitlab::config/credentials/gitlab/0/username'}
+swh::deploy::worker::swh_lister_gitlab::db::password: swh::deploy::worker::swh_lister_gitlab::db::password
+swh::deploy::worker::swh_lister_pypi::db::password: swh::deploy::worker::swh_lister_pypi::db::password
+swh::deploy::worker::task_broker::password: swh::deploy::worker::task_broker::password
+users:
+  anlambert: {password: users/anlambert/password}
+  ardumont: {password: users/ardumont/password}
+  ddouard: {password: users/ddouard/password}
+  ftigeot: {password: users/ftigeot/password}
+  grouss: {password: users/grouss/password}
+  olasd: {password: users/olasd/password}
+  seirl: {password: users/seirl/password}
+  vlorentz: {password: users/vlorentz/password}
+  zack: {password: users/zack/password}
+varnish::secret: varnish::secret
diff --git a/hostname/jenkins-debian1.internal.softwareheritage.org.yaml b/hostname/jenkins-debian1.internal.softwareheritage.org.yaml
new file mode 100644
index 0000000..0a17c78
--- /dev/null
+++ b/hostname/jenkins-debian1.internal.softwareheritage.org.yaml
@@ -0,0 +1 @@
+{'jenkins::agent::jnlp::token': 'jenkins::agent::jnlp::token'}
diff --git a/hostname/moma.softwareheritage.org.yaml b/hostname/moma.softwareheritage.org.yaml
new file mode 100644
index 0000000..1dbe004
--- /dev/null
+++ b/hostname/moma.softwareheritage.org.yaml
@@ -0,0 +1 @@
+{'varnish::secret': 'varnish::secret'}