secrets.pp

$variables = {
  'password' => 'this is my passphrase'.node_encrypt::secret,
}

# compile the template source into the catalog
file { '/etc/secrets.conf':
  ensure  => file,
  content => Deferred('inline_epp',
               ['PASSWORD=<%= $password %>', $variables]),
}