Secrets the system generates itself (secret_key_base, signing and sealing keys), kept in the data directory, readable by their owner only.

A host never holds a secret it must not lose: the app generates it on first boot, and it travels with the data. An explicit env var still wins, in the app's own configuration.

• Generated once, 64 random bytes by default, base64.
• Written atomically: a temporary file, mode 0600, then a rename, so a crash leaves no partial secret and no window where the file is readable by others.
• Checked on every read: a file readable by group or others raises, naming the file and its mode, rather than using a secret that may have leaked.
• Restorable: put!/3 writes a given secret, for a restore from backup.