I appreciate highly that MAS uses Figment to load the configuration, since it makes it easy to set configuration values I do want to keep a secret.
Besides the built-in secrets.*_file and secrets.keys_dir I would like to keep the database uri secret.
However neither the general config docs nor the reference docs document that one can use environment variables to set config values - in my specific example the database uri can be set using env var MAS_database.uri or MAS_database_uri, but this only works if no value is set in config.yaml for database.uri (else the value in config.yaml has precedence).
And while I had to dig this out by reading the code I would like to prepare a PR documenting it in both places after I'm done setting up MAS for my homeserver.