From d95d13b7233433a3648f45b27509ef6e66c6c2df Mon Sep 17 00:00:00 2001
From: muffin <MonsterMuffin@users.noreply.github.com>
Date: Mon, 15 Jun 2026 22:20:28 +0100
Subject: [PATCH 1/2] feat: add Docker secrets support

---
 .github/workflows/docker-build.yml |  2 +-
 README.md                          | 31 ++++++++++++++++++++++++++++++
 qsticky/config.py                  |  2 +-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 029aa86..d037781 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -3,7 +3,7 @@ name: Build and Push Multi-Arch Image
 on:
   workflow_dispatch:
   push:
-    branches: [ main, dev, qbit-session ]
+    branches: [ main, dev, qbit-session, feat/docker-secrets ]
     tags:
       - 'v*'
 
diff --git a/README.md b/README.md
index c42b26f..b03c16b 100644
--- a/README.md
+++ b/README.md
@@ -318,6 +318,37 @@ All configuration is done through environment variables:
 | GLUETUN_PASSWORD | Gluetun basic auth password | "" |
 | GLUETUN_APIKEY | Gluetun API key | "" |
 
+## Docker Secrets
+
+You may use [Docker secrets](https://docs.docker.com/compose/how-tos/use-secrets/) to store sensitive credentials. Environment variables take precedence if both are set.
+
+Secret file names must match the lowercase field names below:
+
+| Secret name | Replaces env var |
+|---|---|
+| `qbittorrent_user` | `QBITTORRENT_USER` |
+| `qbittorrent_pass` | `QBITTORRENT_PASS` |
+| `qbittorrent_api_key` | `QBITTORRENT_API_KEY` |
+| `gluetun_username` | `GLUETUN_USERNAME` |
+| `gluetun_password` | `GLUETUN_PASSWORD` |
+| `gluetun_apikey` | `GLUETUN_APIKEY` |
+
+### Example
+
+```yaml
+secrets:
+  qbittorrent_api_key:
+    file: ./secrets/qbittorrent_api_key.txt
+  gluetun_apikey:
+    file: ./secrets/gluetun_apikey.txt
+
+services:
+  qsticky:
+    ... # qsticky config ... #
+```
+
+Each secret file should contain only the secret value.
+
 ## Verification
 
 To verify qSticky is working:
diff --git a/qsticky/config.py b/qsticky/config.py
index ff05adf..964d556 100644
--- a/qsticky/config.py
+++ b/qsticky/config.py
@@ -72,7 +72,7 @@ class Settings(BaseSettings):
         description="Gluetun API key"
     )] = ""
 
-    model_config = ConfigDict(env_prefix="")
+    model_config = ConfigDict(env_prefix="", secrets_dir="/run/secrets")
 
 
 @dataclass

From c4b364501158bf03062ed4e29d8941c1b5f64741 Mon Sep 17 00:00:00 2001
From: muffin <MonsterMuffin@users.noreply.github.com>
Date: Mon, 15 Jun 2026 22:20:40 +0100
Subject: [PATCH 2/2] ci: build on custom branches

---
 .github/workflows/docker-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index d037781..3d0099d 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -3,7 +3,7 @@ name: Build and Push Multi-Arch Image
 on:
   workflow_dispatch:
   push:
-    branches: [ main, dev, qbit-session, feat/docker-secrets ]
+    branches: [ main, dev, qbit-session, feat/*, fix/*, hotfix/* ]
     tags:
       - 'v*'