Most of the answers here relate to the handling of credentials, probably due to this explicit question in the OP:

> What's the best way to manage the "secrets" (passwords, private keys, MFA access) in this documentation to ensure it remains comprehensive without compromising security?

However, the title asks a different question, which I don't see addressed:

> Developing a secure hit by a bus plan

**The answer the _that_ question is automation.**

In devops, I find that most of the server side of the position falls into two categories:

* **Fix the infrastructure**: Here is usually nothing to automate: every problem is different. In those cases familiarity with the infrastructure (servers, network, how the devs interact with the Git repos) is key.

* **Maintain the infrastructure**: Create new VM instances, set up [Apache](https://github.com/dotancohen/burton), enable dev access to resources, etc. _This is the place where automation is most visible._

Those the role of automation in the latter is obvious, the key to successfully fixing problems in the former is **automation in the latter**. The automated Python and Bash scripts serve as **living documentation** of what is _expected_ of the servers and network: when the workflow changes it is the scripts that change. Git records changes that may be applicable to older servers, and git commit messages are explicit.