From d05b9ce32474430108f7e702ec4d9be468c177be Mon Sep 17 00:00:00 2001
From: Noste <83548733+Noooste@users.noreply.github.com>
Date: Sat, 23 May 2026 15:43:26 +0200
Subject: [PATCH] docs: update README to include loading sensitive values from
 files with _FILE suffix

Signed-off-by: Noste <83548733+Noooste@users.noreply.github.com>
---
 README.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/README.md b/README.md
index 529f005..5ad0b3e 100644
--- a/README.md
+++ b/README.md
@@ -139,6 +139,37 @@ GARAGE_UI_GARAGE_ENDPOINT=http://garage:3900
 GARAGE_UI_GARAGE_ADMIN_TOKEN=your-token
 ```
 
+#### Loading sensitive values from files (`_FILE` suffix)
+
+For Docker/Kubernetes secret integration, sensitive env vars can be read from files instead of plain values. Set `{VAR}_FILE=/path/to/file` and garage-ui reads the file's contents (trailing CR/LF trimmed) as the value. If both `{VAR}` and `{VAR}_FILE` are set, `_FILE` wins and a warning is logged. A missing or unreadable file causes startup to fail.
+
+Supported vars:
+
+- `GARAGE_UI_GARAGE_ADMIN_TOKEN_FILE`
+- `GARAGE_UI_AUTH_ADMIN_USERNAME_FILE`
+- `GARAGE_UI_AUTH_ADMIN_PASSWORD_FILE`
+- `GARAGE_UI_AUTH_JWT_PRIVATE_KEY_FILE`
+- `GARAGE_UI_AUTH_OIDC_CLIENT_ID_FILE`
+- `GARAGE_UI_AUTH_OIDC_CLIENT_SECRET_FILE`
+
+Example with Docker Compose secrets:
+
+```yaml
+services:
+  garage-ui:
+    image: noooste/garage-ui:latest
+    environment:
+      GARAGE_UI_AUTH_ADMIN_PASSWORD_FILE: /run/secrets/admin_password
+    secrets:
+      - admin_password
+
+secrets:
+  admin_password:
+    file: ./admin_password.txt
+```
+
+This matches the convention used by the official Postgres and MySQL Docker images. Helm users do not need this — the chart already injects secrets via `existingSecret` references.
+
 ## Garage Configuration
 
 Garage UI requires these settings in your `garage.toml`: