# Run on the isolated remote Agent host; never commit ./private-secrets.
services:
  agent:
    volumes:
      - ./private-secrets:/run/secrets:ro