# Per-environment overrides + secrets. defaults.env (committed) holds the
# defaults; .env is layered over it (COMPOSE_ENV_FILES=defaults.env,.env) and
# holds only your per-LAN values + secrets — never commit it.
.env