How do you manage .env secrets when deploying Compose stacks from Git?

The simple option is to keep the real .env file on the server and add it to .gitignore. Commit a .env.template with placeholder values and a note about which variables each stack needs.

That makes the Compose configuration reproducible, but the secrets still need their own backup or recovery plan. The template tells you what to restore, not what the values were.

Take a look at SOPS if you want the secrets alongside the Compose files in Git. It lets you commit an encrypted secrets file instead of the plaintext values.

You still need to manage the decryption key separately and make it available to the deployment process. Back up that key securely too, or the encrypted file won't help much with recovery.

A secret manager is another route. For example, a deployment pipeline can authenticate to HashiCorp Vault with AppRole and generate the required environment file at deploy time. That avoids storing the plaintext file in the repo, though you still need to protect the pipeline credentials and any generated file.

It adds moving parts, so I wouldn't start there just because there are a few variables.

If you already use 1Password, its CLI can inject secrets at runtime. That can work with configuration beyond Compose too, so you don't necessarily need a separate self-hosted service just for these files.

It helps to separate the pieces on disk. Keep Compose files and configuration templates in Git, persistent application data in its own directory, and secret files in a restricted directory outside the checkout. Then make sure your deployment configuration points to the right files.

This won't provide backups by itself, but it makes it clearer which data and secrets need protecting separately from the repository.