The heredoc creates the file with default umask permissions (644 — world-readable). Setting 600 immediately after creation prevents other processes on the host from reading the Grafana, GlitchTip, and Postgres credentials. Defence-in-depth for the single-tenant VPS. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>