{# Non-secret defaults first, then Vault secrets — secrets win on key clashes. #}
{% for key, value in (env_defaults | default({})).items() %}
{{ key }}="{{ value }}"
{% endfor %}
{% for key, value in (vault_secrets | default({})).items() %}
{{ key }}="{{ value }}"
{% endfor %}