diff --git a/.gitignore b/.gitignore
index 7a7b2f3a4..12d34f065 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,5 @@ run
 
 temp
 
-
 ### Docker ###
 containers/data
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 000000000..d3bc760c6
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "PrivateConfig"]
+	path = PrivateConfig
+	url = git@github.com:CivMC/PrivateConfig
diff --git a/PrivateConfig b/PrivateConfig
new file mode 160000
index 000000000..5689aa252
--- /dev/null
+++ b/PrivateConfig
@@ -0,0 +1 @@
+Subproject commit 5689aa25256d0975a6f1065b3dd9742326333472
diff --git a/README.md b/README.md
index 8d1eacb0c..44d186895 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,13 @@
 
 This monorepo will eventually contain all civ projects and development
 
+## Key Technologies
+
+- [Gradle](https://gradle.org/) Is used as an entrypoint to build all projects in this repository.
+- [Docker](https://www.docker.com/) Is used to containerize any deployed services,
+  and provide a somewhat consistent development environment.
+- [Ansible](https://www.ansible.com/) Is used to configure the target machines and for final deployment
+
 ## Developing Locally
 
 ### Plugins
@@ -32,6 +39,17 @@ Current services and exposed ports are:
 |          | 15672 | HTTP, Management UI |            |
 | grafana  | 3000  | HTTP, Grafana UI    | monitoring |
 
+### Private Config
+Sensitive information is stored in a private repository, and required for Ansible deployment.
+If you have access to this, you can get the submodule with `git submodule init` and `git submodule update`
+
+To use this with the local docker-compose stack,
+you can use `docker compose up -f docker-compose.yml -f docker-compose.private.yml` to merge the configurations.
+
+Hot tip: If you use different SSH keys for your Civ GitHub account, you might use an SSH alias (`git clone git@civmc.github.com:...`).
+If this is the case, you can clone the submodule by setting the`GIT_SSH_COMMAND`environment variable
+to `ssh -i /path/to/your/private/key` before updating the submodule.
+
 #### Using the console
 For the minecraft servers and other interactive containers, you can attach to the console to run commands:
 
diff --git a/docker-compose.private.yml b/docker-compose.private.yml
new file mode 100644
index 000000000..e062fe202
--- /dev/null
+++ b/docker-compose.private.yml
@@ -0,0 +1,33 @@
+# Private Config Extension for Docker Compose.
+# Requires PrivateConfig submodule to be cloned.
+
+services:
+
+  #################
+  ### Minecraft ###
+  #################
+
+  paper:
+    environment:
+      # Any Jars need to be here, comma separated so that they are not removed during sync
+      REMOVE_OLD_MODS_EXCLUDE: "Vulcan-2.9.0.jar"
+      SYNC_SKIP_NEWER_IN_DESTINATION: "true"
+    # Note that config and plugins are mounted into the DATA directory, to avoid propagating to the config bind mount
+    volumes:
+      - ./PrivateConfig/paper/plugins/Vulcan-2.9.0.jar:/data/plugins/Vulcan-2.9.0.jar
+      - ./PrivateConfig/paper/config/Vulcan/config.yml:/data/plugins/Vulcan/config.yml
+      - ./PrivateConfig/paper/config/HiddenOre/config.yml:/data/plugins/HiddenOre/config.yml
+      - ./PrivateConfig/paper/config/KiraBukkitGateway/config.yml:/data/plugins/KirraBukkitGateway/cnfig.yml
+      - ./PrivateConfig/paper/config/Brewery/config.yml:/data/plugins/Brewery/config.yml
+      - ./PrivateConfig/paper/config/Terra/packs/CivMC:/data/plugins/Terra/packs/CivMC
+      - ./PrivateConfig/paper/config/Votifier/config.yml:/data/plugins/Votifier/config.yml
+      - ./PrivateConfig/paper/config/Votifier/rsa/public.key:/data/plugins/Votifier/rsa/public.key
+      - ./PrivateConfig/paper/config/Votifier/rsa/private.key:/data/plugins/Votifier/rsa/private.key
+      - ./PrivateConfig/paper/config/DiscordSRV/config.yml:/data/plugins/DiscordSRV/config.yml
+      - ./PrivateConfig/paper/config/DiscordSRV/alerts.yml:/data/plugins/DiscordSRV/alerts.yml
+      - ./PrivateConfig/paper/config/MythicMobs:/data/plugins/MythicMobs
+      - ./PrivateConfig/paper/config/EvenMoreFish/baits.yml:/data/plugins/EvenMoreFish/baits.yml
+      - ./PrivateConfig/paper/config/EvenMoreFish/fish.yml:/data/plugins/EvenMoreFish/fish.yml
+      - ./PrivateConfig/paper/config/EvenMoreFish/rarities.yml:/data/plugins/EvenMoreFish/rarities.yml
+      - ./PrivateConfig/paper/config/EvenMoreFish/competitions.yml:/data/plugins/EvenMoreFish/competitions.yml
+      - ./PrivateConfig/paper/config/RandomSpawn/worlds.yml:/data/plugins/RandomSpawn/worlds.yml
diff --git a/docker-compose.yml b/docker-compose.yml
index a1f93acf7..1dff04ed9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -103,7 +103,7 @@ services:
       MYSQL_PASSWORD: mariadb
       MYSQL_DATABASE: mariadb
     volumes:
-      - ./containers/provisioning/mariadb/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
+      - ./containers/provisioning/mariadb/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d:ro
       - ./containers/data/mariadb:/var/lib/mysql
 
   postgres:
@@ -121,7 +121,7 @@ services:
       POSTGRES_PASSWORD: postgres
       POSTGRES_DB: postgres
     volumes:
-      - ./containers/provisioning/postgres/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
+      - ./containers/provisioning/postgres/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d:ro
       - ./containers/data/postgres:/var/lib/postgresql/data
 
   rabbitmq:
@@ -158,4 +158,4 @@ services:
       CIV_INFLUX_ORG: CivMC
       CIV_INFLUX_TOKEN: admintoken
     volumes:
-      - ./containers/provisioning/grafana:/etc/grafana/provisioning
+      - ./containers/provisioning/grafana:/etc/grafana/provisioning:ro