settings/syntax: Describe effect of %variables better

Author: cmouse

docs/core/settings/syntax.md

@@ -436,6 +436,8 @@ However, you must be careful with the ordering of these in the configuration
 file, because the `$SET:variables` are expanded immediately while parsing the
 config file and they're not updated later.
 
+See also [[link,settings_variables]].
+
 ## Environment Variables
 
 It is possible use `$ENV:name` to expand values from environment.
@@ -447,3 +449,9 @@ Note that these are also Case Sensitive.
 
 These can also be used for external config files, but you need to list them in
 [[setting,import_environment]] so that processes can see them.
+
+For [[link,settings_types_file]] it is better to use `$ENV:` instead of `%{env:}`.
+This is because with `$ENV:` the expansion and file reading is done by the config
+process, which normally runs as root. With `%{env:}` the expansion is delayed
+until the process accessing the setting expands it, but the process may not
+have enough permissions to open the file.

docs/core/settings/types.md

@@ -179,7 +179,10 @@ the file permissions don't usually matter. However, some callers need to open
 the file again (e.g. the `ssl_client_cert_file` setting with MySQL) after
 the process has dropped root privileges.
 
-The file paths do not support [[link,settings_variables,%variables]].
+If you use [[link,settings_variables,%variables]] in file names, the expansion
+is delayed until the process accessing the setting expands it. The process
+is usually not running as root at this point, so you may need to adjust file
+permissions.
 
 It's possible to give inline values (instead of a path to a file) for the
 setting by using `inline:` prefix in the value. For example userdb could be