Secret handling
Secret handling: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/ops/secrets. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
This entry is a procedure, not another container to install. Start with the password file used in the backup exercise. A secret is a value whose possession grants access or decrypts data. File paths, permissions, version control, and recovery all affect its protection.
Settings and data
Keep real values outside Git. Commit only placeholder .env.example files. Local Compose secrets mount files into chosen containers; they are not automatically encrypted on disk. Prefer a supported _FILE option over a plaintext value in YAML, and restrict the host directory and file permissions.
Check it
Inspect the packaged practice archive: it must contain no secrets/ directory or password. Test that the intended backup job reads its secret without printing it. Record privately which service owns each credential and how to rotate it without losing access to existing data.
When something fails
A leaked credential must be revoked or rotated; deleting a Git line does not revoke it or erase repository history. An encryption key may require a migration process rather than simple replacement. Never put real secrets in screenshots, expanded Compose output, shell arguments shared publicly, or troubleshooting notes.