Use an env var for the secret key

Rocket.toml

@@ -1,2 +0,0 @@
-[default]
-secret_key = "MHSePvm1msyOkYuJ7u+MtyJYCzgdHCS7QNvrk9ts+rI="

justfile

@@ -1,6 +1,11 @@
 _default:
     @just --list
 
+export SECRET_KEY := "MHSePvm1msyOkYuJ7u+MtyJYCzgdHCS7QNvrk9ts+rI="
+
+[doc("Run the reader locally in demo mode.")] # don't re-use this secret key
+run-local-demo:
+    cargo run -- --demo
 
 sqlx-prepare:
     DATABASE_URL="sqlite:data.sqlite" cargo sqlx prepare

src/main.rs

@@ -99,7 +99,9 @@ fn rocket() -> _ {
         format!("sqlite:{}", database)
     };
 
-    let figment = rocket::Config::figment().merge(("databases.rss_data.url", db_url));
+    let figment = rocket::Config::figment()
+        .merge(("databases.rss_data.url", db_url))
+        .merge(("secret_key", std::env::var("SECRET_KEY").expect("SECRET_KEY environment variable must be set")));
 
     rocket::custom(figment)
         .mount(