slaprunner: secret codes are given through control interface

software/slaprunner/instance-runner.cfg

@@ -363,8 +363,6 @@ backend_url = $${slaprunner:access-url}
 access_url = $${:url}/login
 url =  https://$${request-frontend:connection-domain}
 ssh_command = ssh $${dropbear-runner-server:host} -p $${dropbear-runner-server:port}
-shell_password = $${shellinabox:password}
-password_recovery_code = $${recovery-code:passwd}
 
 #---------------------------
 #--
@@ -455,7 +453,7 @@ port = 8080
 shell = $${shell:wrapper}
 wrapper = $${directory:bin}/shellinaboxd
 shellinabox-binary = ${shellinabox:location}/bin/shellinaboxd 
-password = $${shellinabox-code:passwd}
+password = $${zero-parameters:shell-password}
 directory = $${runnerdirectory:home}
 login-shell = $${directory:bin}/login
 certificate-directory = $${cadirectory:certs}
@@ -497,3 +495,8 @@ recipe = slapos.cookbook:wrapper
 command-line = ${curl:location}/bin/curl -g https://[$${slaprunner:ipv6}]:$${slaprunner:runner_port}/isSRReady --max-time 1 --insecure
 wrapper-path = $${directory:scripts}/prepareSoftware
 
+[public]
+recovery-code = $${recovery-code:passwd}
+shell-password = $${shellinabox-code:passwd}
+
+[zero-parameters]