Hi! As we've talked in chat, we will not move forward with this one, as I don't think the Credentials API is useful for the Decidim use-case. Basically I think we should move forward with having a Decidim installation work better wtih a docker image, and for that we should keep moving to the ENV VAR configurations style (basically what is described at https://12factor.net/config)

Why I don't like Credentials for Decidim: As far as I understand how credentials work, it's adding more complexity to deployments. For us (developers) is not a problem, but for others (more junior developers, implementers that don't know much about Linux) they can be difficult to understand and work with. If the instructions say:

EDITOR=vim ./bin/rails credentials:edit --environment production

Then you need to explain people how to work with vim. There are lots of memes why vim isn't intuitive for newcomers ("how to exit vim" and such), so it's making the barrier of entry higher.

If we need to drop the Secrets API for the update, I'll think in the best way for an update path that's compatible with what we have:

1. Using ENV VARs so we can keep things like https://docs.decidim.org/en/v0.28/configure/environment_variables
2. Moving from Rails.application.secrets.decidim to another API but made by us. Maybe calling Decidim::Env directly in config/initializers/decidim.rb could be enough?

Clsoing in favor of #13268