# Secrets

!!! warning "Secrets never go in the image"
    We do **not** commit secrets (usually, lol). They stay **gitignored** and live on
    the host in your config dir, reaching your container read-only via `${CONFIG_DIR}`.
    Add them to `.dockerignore` so a `COPY . .` can't sweep them into a layer.

## How it works

- Secrets live on the **host**, in your config dir — never in git, never in the image.
- They reach the container **read-only** via the injected `${CONFIG_DIR}` mount (see
  **[Compose convention](compose.md)**).
- Keep them out of the build context: list them in `.dockerignore` so a blanket
  `COPY . .` can't pull them into a layer.

## Rotating a secret

A host-side edit — update the file and the service picks it up on restart. No rebuild,
and nothing you run: flag it and we handle the restart.