# Secrets (git-ignored)

Drop credential files here. This directory is mounted read-only into the
`notifications` worker at `/app/secrets`.

## Firebase Cloud Messaging (Android push, and iOS later)

1. Firebase Console → ⚙ Project settings → **Service accounts** →
   **Generate new private key** → download the JSON.
2. Save it here as `fcm-service-account.json`.
3. In `.env`, set:
   `FCM_SERVICE_ACCOUNT_FILE=/app/secrets/fcm-service-account.json`
4. Recreate the worker: `docker compose up -d --force-recreate notifications`

Until this is set, native (FCM) push is disabled and the worker logs
"fcm disabled (no service account configured)". Web Push works without it.