Configuration
Secrets
The file holds names and paths, never values.
This file holds NAMES, never values. credentials_env, postgres_dsn_env and
couchdb_credentials_env each carry the name of an environment variable. A
configuration file that contains a secret is a payload, not configuration.
credentials_file carries a path; the engine refuses to read it unless it is owner-only
(0600), and each of the ways this can fail has its own named refusal class:
lane-unknown, lane-credentials-file-undeclared, lane-credentials-file-mode,
lane-credentials-file-absent, lane-credentials-var-absent. The credential value itself
never appears in any message, argv, or record.