The secret is read by hydra-server which is run under hydra-www so that needs to be able to read the file.