I am using Docker Compose to deploy OneDev with an external database (MariadDB). And I'm trying to hide sensitive data with Docker Secrets. For MariaDB, I use "MARIADB_ROOT_PASSWORD_FILE" and "MARIADB_PASSWORD_FILE" instead of "MARIADB_ROOT_PASSWORD" and "MARIADB_PASSWORD" respectively. This works, but I can't find a way to insert "/run/secrets/secret" in "hibernate_connection_password" and "initial_password" in OneDev's environment section in docker-compose.yaml. Is it possible? Or is there another way not to use sensitive data in docker-compose.yaml?

volumes:
  onedev:
  mariadb:

services:
  nginx:
    container_name: nginx
    image: nginx
    volumes:
      - /etc/ssl/:/etc/ssl/
      - ./html:/usr/share/nginx/html
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/nginxconfig.io:/etc/nginx/nginxconfig.io
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
    ports:
      - "##.###.##.###:80:80"
      - "##.###.##.###:443:443"

  onedev:
    container_name: 1dev
    image: 1dev/server
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - onedev:/opt/onedev
    environment:
      hibernate_dialect: org.hibernate.dialect.MySQL5InnoDBDialect
      hibernate_connection_driver_class: org.mariadb.jdbc.Driver
      hibernate_connection_url: jdbc:mariadb://mariadb:3306/onedev
      hibernate_connection_username: admin
      hibernate_connection_password: /run/secrets/db_password
      initial_user: admin
      initial_password: /run/secrets/onedev_password
      initial_email: admin@example.com
      initial_server_url: localhost:6610
    secrets:
      - db_password
      - onedev_password

  mariadb:
    container_name: mariadb
    image: mariadb
    restart: always
    environment:
      MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
      #MARIADB_ROOT_HOST: localhost
      #MARIADB_MYSQL_LOCALHOST_USER: true
      MARIADB_DATABASE: onedev
      MARIADB_USER: admin
      MARIADB_PASSWORD_FILE: /run/secrets/db_password
      MARIADB_AUTO_UPGRADE: true
    secrets:
      - db_root_password
      - db_password
    volumes:
      - mariadb:/var/lib/mysql

  adminer:
    container_name: adminer
    image: adminer
    restart: always

secrets:
  db_password:
    file: .secrets/db_password.txt
  db_root_password:
    file: .secrets/db_root_password.txt
  onedev_password:
    file: .secrets/onedev_password.txt