It is recommended you keep your secrets separate from the configuration. It's especially important to keep the raw secrets out of your nix configuration, as the values will be preserved in your nix store. This attribute allows you to configure the location of secret files to be loaded at runtime.
https://www.authelia.com/configuration/methods/secrets/