Secret refs (env and file)

On DNS servers and Webhooks, secret fields look like:

env:LATTICE_TSIG_SECRET
file:/etc/lattice/lattice.keytab
env:LATTICE_POWERDNS_API_KEY
env:LATTICE_WEBHOOK_SECRET

The worker and dhcpd process read the env or file at runtime. The console will not show the bytes again. Put the value in the unit’s EnvironmentFile= or a tmpfs file with mode 0600.

Wrong ref → outbox errors, not a rolled-back lease. Fix the file, then retry dead letters (Outbox).

Do not paste a TSIG secret into a reservation description or a ticket.