docs(paas): document file secrets in vault commands

.wordlist.txt

@@ -297,6 +297,7 @@ CycloneDX
 DAL
 DBAL
 DDL
+DER
 DESC
 DHL
 DIC
@@ -1703,6 +1704,8 @@ jwt
 kebabCase
 keyframes
 keypress
+keystore
+keystores
 landingpage
 lang
 lavinmq

products/paas/shopware/fundamentals/secrets.md

@@ -14,14 +14,25 @@ Secrets stored in Vault are reusable, which means that you can reuse a secret va
 
 A secret is composed of a type, a key, and a value. Once created, it is assigned a unique `secret-id`, which is required for retrieving or deleting the secret.
 
-The supported types are `env`, `buildenv`, and `ssh`. `env` is available at runtime in the application, `buildenv` is accessible during build processes, and `ssh` keys are for secure connections.
+The supported types are `env`, `buildenv`, `ssh`, and `file`. `env` is available at runtime in the application, `buildenv` is accessible during build processes, `ssh` keys are for secure connections, and `file` secrets are mounted as a file at an absolute path inside the application container.
 
 To create a secret, use the following command:
 
 ```sh
 sw-paas vault create
 ```
 
+### File secrets
+
+A `file` secret is written to a file inside the container instead of being exposed as an environment variable. Use `--path` to set the absolute mount path and `--file` to read the value from a local file:
+
+```sh
+sw-paas vault create --type file --key CLIENT_CERT \
+  --path /var/www/certs/client.pem --file ./client.pem
+```
+
+The value is stored verbatim, so binary content such as keystores or DER certificates stays intact. If you omit `--path`, the CLI prompts for it. The file is mounted read-only and is not executable.
+
 ## Listing all Vault secrets
 
 ```sh

products/paas/shopware/guides/secrets-vault-guide.md

@@ -15,16 +15,18 @@
 - Environment variables
 - Build-time secrets
 - SSH keys for accessing private Git repositories
+- Files such as certificates or keystores
 
 Secrets stored in the Vault are reusable across all applications in your organization.
 
 ## Secret Types
 
-| Type       | Description                                |
-| ---------- | ------------------------------------------ |
-| `env`      | Runtime environment variables for your app |
-| `buildenv` | Build-time environment variables           |
-| `ssh`      | SSH keys for secure Git access             |
+| Type       | Description                                        |
+| ---------- | -------------------------------------------------- |
+| `env`      | Runtime environment variables for your app         |
+| `buildenv` | Build-time environment variables                   |
+| `ssh`      | SSH keys for secure Git access                     |
+| `file`     | Files mounted at an absolute path in the container |
 
 ## Creating a Secret
 
@@ -46,6 +48,44 @@
 
 After generation, the CLI will output the public key. Add this to your Git hosting provider (e.g., GitHub under **Deploy Keys**).
 
+### Creating a File Secret
+
+A `file` secret is mounted as a file inside the application container, for example a client certificate or a Java keystore:
+
+```sh
+sw-paas vault create --type file --key CLIENT_CERT \
+  --path /var/www/certs/client.pem --file ./client.pem
+```
+
+| Flag     | Description                                                                     |
+| -------- | ------------------------------------------------------------------------------- |
+| `--path` | Absolute path the file is mounted at inside the container. Prompted if omitted. |
+| `--file` | Local file to read the value from. The content is stored verbatim.              |
+
+`--file` keeps binary content intact. Alternatively, pipe the content with `--password-stdin`; for `file` secrets, stdin is also read unmodified.
+
+::: info
+File secrets are mounted read-only and without execute permission. Your application can read the file, but cannot modify or execute it.
+:::
+
+## Updating a Secret
+
+To change the value of an existing secret:
+
+```sh
+sw-paas vault update --secret-id SECRET-ID
+```
+
+Use `--file` or `--password-stdin` to provide the new value non-interactively.
+
+For `file` secrets, `--path` moves the secret to a different mount path. Without `--file` or `--password-stdin`, only the path changes and the content is kept:
+
+```sh
+sw-paas vault update --secret-id SECRET-ID --path /var/www/certs/new-client.pem
+```
+
+If you omit `--path`, the stored path stays untouched. In an interactive terminal, the CLI asks whether you want to change it.
+
 ## Retrieving a Secret
 
 Secrets are accessed by their unique `secret-id`. You can retrieve a secret using: