.dev.vars for local, and secrets for production..dev.vars (the latter didn't work for me). So this necessitates having two TOML files - one production, one local - the local one being denoted via the --config param, because putting the connection string in the main TOML would mean committing DB credentials.