host     portal.fwrk.dev
scope    portal   (first label, as HostScopeResolver::byLabel)
install  /srv/fwrk
runs as  site-fwrk
own var  secret of fwrk

vault's   unreadable (good)