1 files changed, 17 insertions, 17 deletions

diff --git a/README.md b/README.md
index 9014e1b..5c8e1dc 100644
--- a/README.md
+++ b/README.md
@@ -76,14 +76,15 @@ nixosConfigurations.poweredge = nixpkgs.lib.nixosSystem {
     collectors.enable = true;
     server = {
       enable = true;
-      grafana.secretKeyFile = "/run/secrets/grafana-secret-key";
       proxy.enable = true;                     # Grafana on :80
     };
   };
 }
 ```
 
-Grafana at `http://localhost`. `collectorHosts` defaults to `[ "localhost" ]`.
+Grafana at `http://localhost`. `collectorHosts` defaults to `[ "localhost" ]`, and
+Grafana's secret key is generated on first start into `/var/lib/grafana/secret-key`
+(mode 0600, owned by `grafana`) — see below if you would rather supply it yourself.
 
 ## Example: web services in a container
 
@@ -91,7 +92,7 @@ The host runs the collectors; the container runs everything else. This is the in
 shape.
 
 ```nix
-{ config, inputs, ... }:
+{ inputs, ... }:
 {
   imports = [ inputs.telemetry.nixosModules.collectors ];
 
@@ -100,23 +101,12 @@ shape.
     logs.lokiUrl = "http://metrics:3100";      # the container, by name
   };
 
-  sops.secrets.grafana-secret-key = {
-    sopsFile = ./secrets/grafana.yaml;
-    key = "secret_key";
-  };
-
   containers.metrics = {
     autoStart = true;
     privateNetwork = true;
     hostBridge = "br-lan0";
     localMacAddress = "02:00:00:00:00:06";
 
-    # The module reads whatever path you point secretKeyFile at.
-    bindMounts."/run/grafana-secret-key" = {
-      hostPath = config.sops.secrets.grafana-secret-key.path;
-      isReadOnly = true;
-    };
-
     config = { ... }: {
       imports = [ inputs.telemetry.nixosModules.server ];
 
@@ -126,7 +116,6 @@ shape.
       services.telemetry.server = {
         enable = true;
         collectorHosts = [ "poweredge" ];       # the host above
-        grafana.secretKeyFile = "/run/grafana-secret-key";
         proxy.enable = true;
       };
 
@@ -262,8 +251,19 @@ inventing placeholder values.
   render "No data". Don't configure the Grafana datasource by hand.
 - **The datasource UIDs `prometheus` and `loki` are fixed, not options.** The generated
   dashboards reference them literally.
-- **Grafana's secret key is mandatory** as of nixpkgs 26.05. `openssl rand -base64 32`,
-  store it somewhere, point `grafana.secretKeyFile` at it.
+- **Grafana's secret key is mandatory** as of nixpkgs 26.05, because Grafana's upstream
+  default is a constant compiled into every release. By default this module generates one
+  on first start into `/var/lib/grafana/secret-key` (0600, owned by `grafana`), so there
+  is nothing to wire up. Two things to know: it must stay *stable*, or credentials
+  encrypted in Grafana's database stop decrypting — so keep the Grafana data directory on
+  persistent storage; and it sits beside the database it protects, so it defends against
+  a stolen `grafana.db` but not against filesystem access. Set
+  `grafana.secretKeyFile` to a path you manage instead once the database holds anything
+  worth protecting, such as a datasource password:
+  ```nix
+  services.telemetry.server.grafana.secretKeyFile =
+    config.sops.secrets.grafana-secret-key.path;   # turns generation off
+  ```
 - **Changing `collectorHosts` changes the label set.** Panels look empty for a minute
   after first deploy while the recording rules re-evaluate; data from before the change
   stays under the old labels.