Everything that uses configuration files should report where they're located
Consider writing a FUSE filesystem driver that generates configuration files on the fly in response to some secure source of truth. It skips one of the middlemen in terms of configuration management and makes programmatic reconfiguration more accessible.