diff --git a/new/README.md b/new/README.md
index ac9ad8b..8be9089 100644
--- a/new/README.md
+++ b/new/README.md
@@ -4,3 +4,16 @@
 
 Each VPS has a caddy running _on the host_, not inside docker. It's the entrypoint to the stuff.
 Everything else runs in a docker container via docker compose.
+
+## extra setup
+
+every app needs some secrets in places.
+
+there are also "global secrets" used for the docker-compose, for example
+for env vars. those should be placed in `/apps/.env`.
+
+Right now the global secrets are
+
+```
+KILLUA_BOT_TOKEN=
+```