How do you hide sensitive information held in variables on a docker-compose file

I am fairly new to DevOps. I have managed to build myself a CI/DI pipeline for my open source project.

As soon as I check-in some code into GitHub, Travis CI takes over, it builds a fresh docker image of my code, pushes it to DockerHub, then the after_success step within my .travis.yml connects to my VPS via SSH, and runs a script on there which basically does a docker-compose down followed by a docker-compose pull && docker compose up.

All seems to be working correctly. But I have an issue with my docker-compose.yml. Right now as you can see, it has all my environmental variables. Those are considered secret information. How do I hide them from the docker-compose.yml file whilst having everything still working as before?

UPDATE

I went and created myself a variables.env file in the same directory as the docker-compose.yml. Inside the .env file, I put my old variables, for example:

Database__DefaultConnectionString: "Server=database;Port=5432;Database=bejebeje_identity;User Id=postgres;Password=admin;"

But in Travis CI I get the following error:


environment variable name 'Database__DefaultConnectionString: "Server' may not contains whitespace.

Use environment variables on your host that are read by your docker-compose.yml file. There are a couple ways to accomplish this. One way is to create a .env file on the host that contains your variables. Docker Compose will read these variables and apply them to your configuration.

Alternatively, or in conjunction with a .env file, you can set environment variables in your shell. These variables will be applied the same way as those read from a .env file and actually take precedence.

Read more here: https://docs.docker.com/compose/environment-variables/

StackExchange DevOps Q#6731, answer score: 4