Inject per-app configuration and secrets

An app's configuration and secrets — where its database is, its API keys — are declared once, in kixctl, and injected into every revision of that app at launch. A freshly built revision comes up already knowing where its state lives, which is what makes an update feel continuous even though the running instance is entirely new.

How it is stored and delivered

Values are stored in kixctl's own database, encrypted at rest under APP_KEY (itself a sops-managed secret). At launch, each value is delivered into the container as a read-only credential file through systemd's credential mechanism, and exposed to the app as an environment variable. The value is not baked into the image and is not visible in the instance's configuration.

Why it matters

This injection is what puts state outside the revision. The immutable image holds no durable data; the app connects to an external database using the injected config. Because every revision — including one you revert to — receives the same pointer to that external state, promoting or reverting a revision never touches the data. See Rollback and the state boundary.