The way I do it is to set the `EnvironmentFile` entry in the service definition. I'd guess that the author's idea is that if someone gains access to the server

The way I do it is to set the `EnvironmentFile` entry in the service definition. I'd guess that the author's idea is that if someone gains access to the server, the secrets would be either dumped from the binary or the environment file, if so, why to bother with another file?