Inject file-based secrets into a Docker Compose service

Documented steps

1. Define the secret in the top-level `secrets` element with `file:` pointing at a file on disk: secrets: { my_secret: { file: ./my_secret.txt } }.
2. Grant the secret to a service by listing it under that service's `secrets` attribute: services: { myapp: { image: myapp:latest, secrets: [my_secret] } }.
3. Compose mounts the secret contents into the container at /run/secrets/my_secret (the filename matches the secret key).
4. Configure the app to read the secret from that path rather than an environment variable.
5. Official docs: https://docs.docker.com/compose/how-tos/use-secrets/ and https://docs.docker.com/reference/compose-file/secrets/