Yeah, that .sh script gets that referenced value of USERS from a variable. That is the secret value of USERS. I mean you can hard-code that value of USERS in there, if you want to. But generally it’s not a good idea to do that. As that would include a password, which you generally want to keep secret. Out of repos etc.
Since variables can be provided by Fly in multiple ways: the [env] block of the fly.toml, in the command line with -e, or via secrets. You’ll see the [env] was used here for non-secret things, like the port stuff. The USERS could be set in there too. It would work in exactly the same way. But again, that would exposes its contents to anyone who has access to your code. Using a secret keeps it, er, secret 