Something like pa should be easy enough to port to it as a first pass:
https://github.com/biox/paIMO Vault is really nice, but something as simple as possible is better for managing secrets, especially when the storage layer has permission and sane encryption handled for you.