Docker compose in git. Env in 1password or whatever password manager you use. Most support uploading a raw file.