One home for every secret and every variable the fleet's services read instead of an env file on each box.
There is no browsable configuration here and no login. Every value is reached with a foltz-id credential scoped to one service:
GET /api/resolve · GET /api/env ·
PUT /api/records
GET /livez answers without a token, so an updater can probe it.
GET /healthz does not.
There is deliberately no MCP surface: the one thing an agent must not be able to do casually is read every credential in the fleet.