Document secrets.encryption_file

Signed-off-by: Kai A. Hiller <[email protected]>

Author: V02460

docs/reference/configuration.md

@@ -232,6 +232,21 @@ secrets:
         -----END EC PRIVATE KEY-----
 ```
 
+### `secrets.encryption{_file}`
+
+The encryption secret used for encrypting cookies and database fields. It takes
+the form of a 32-bytes-long hex-encoded string. To provide the encryption secret
+via file, set `secrets.encryption_file` to the file path; alternatively use
+`secrets.encryption` for declaring the secret inline. The options
+`secrets.encryption_file` and `secrets.encryption` are mutually exclusive.
+
+If given via file, the encyption secret is only read at application startup.
+The secret is not updated when the content of the file changes.
+
+> ⚠️ **Warning** – Do not change the encryption secret after the initial start.
+> Changing the encryption secret afterwards will lead to a loss of all
+> information stored in the database.
+
 ### `secrets.keys`
 
 The service can use a number of key types for signing.