[xandrius]

For secrets, just literally have an ssh command which reads the local .env file and uses them to start the server with them as arguments/env vars.