Read from credential files

See https://systemd.io/CREDENTIALS/. This will also work for Docker
Secrets by setting `CREDENTIALS_DIRECTORY=/run/secrets`.

pkg/shell/shell.go

@@ -3,6 +3,7 @@ package shell
 import (
 	"os"
 	"os/signal"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"syscall"
@@ -51,6 +52,13 @@ func ReplaceEnvVars(text string) string {
 			dok = true
 		}
 
+		if dir, vok := os.LookupEnv("CREDENTIALS_DIRECTORY"); vok {
+			value, err := os.ReadFile(filepath.Join(dir, key))
+			if err == nil {
+				return strings.TrimSpace(string(value))
+			}
+		}
+
 		if value, vok := os.LookupEnv(key); vok {
 			return value
 		}