diff --git a/.gitignore b/.gitignore
index 1f89b79..fa0a277 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+/.seed
 /certbot/lib/
 /certbot/www/
 /certs/
diff --git a/TODO.on.site b/TODO.on.site
index 56a0960..da83a0e 100644
--- a/TODO.on.site
+++ b/TODO.on.site
@@ -1,3 +1,8 @@
+Create secret seed:
+We use a single secret seed that internal passwords (e.g.
+robot mail accounts, databases) are derived from.
+* `dd if=/dev/urandom bs=1 count=16 | base 64 >.seed`
+
 Create environment files (cf. `git ls-files \*environment.template`):
 * Set SA_PUBLIC_DOMAIN_NAME in `environment`
 * Set CANONICAL_WEB_URL in `gerrit/environment`
diff --git a/docker-compose.yml b/docker-compose.yml
index 65dccaf..0b60856 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -154,3 +154,6 @@
     ipam:
       config:
         - subnet: 10.12.14.48/29
+secrets:
+  seed:
+    file: .seed