> ## Documentation Index > Fetch the complete documentation index at: https://docs.shipways.dev/llms.txt > Use this file to discover all available pages before exploring further. # The environment file > Where a site's configuration lives, and the two ways of getting it there. The `.env` a site reads its configuration from lives in the site's `shared` directory on the server and is linked into every release. That is what makes it survive a deploy. It is **not** stored in Shipways. Editing it reads the file off the machine on demand, which is also why a site's settings page still opens when the machine is unreachable — the file simply is not there to show. ## Reading and editing it Reading needs permission to **change** the site, because the file holds the site's secrets. Fetching the file is one decision and putting it on screen is another. Every line of it is a secret, and a settings page gets opened as often to check a domain as to change a key, frequently with somebody watching — so it stays hidden behind **Reveal** until you say otherwise. Saving writes the file and **rebuilds the configuration cache**, without which nothing would change: a Laravel application running `config:cache` reads the cache, not the file. Queue workers hold their configuration until they restart. A change that matters to them needs the [daemon](/processes/daemons) restarting too. ## Earlier versions Every save keeps the previous contents, with who saved it and when. Restoring one puts it back the same way a save does, cache rebuild included. This is the thing to reach for when a deploy started failing right after somebody edited configuration. ## Where the first one comes from Shipways seeds the file on the **first deploy** and never touches it again. That is the only moment it can fill in a working `DB_` block, which is why [connecting a database](/sites/creating#connecting-a-database) when the site is created is worth doing. A fresh `APP_KEY` is generated at the same time. ## Encrypted environment files If your repository carries a `.env.encrypted`, give Shipways the key and each release decrypts its own instead of being handed the shared one. A site set up this way is **not** given the shared file at all — nothing is linked over the top of it, because a link there would either be overwritten or would send the decrypted file back into the shared copy. The panel says so on the Environment tab: what you are looking at there is not what the site is running. The key is kept encrypted and never shown again. Saving an empty box takes it away and puts the site back on the shared file.