feat: use Docker secrets for password

Using environment variables for secret data like passwords is an
anti-pattern as they can easily leak. It's much safer to maintain the
data as a file. To prevent accidental commits of the password file, we
are adding a `.gitignore` file.

docker-compose/postgres/.gitignore

@@ -0,0 +1 @@
+secret.*

docker-compose/postgres/docker-compose.yaml

@@ -6,7 +6,7 @@ services:
     image: docker.io/library/postgres:16.2
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
       # (Optional) when creating a new database
       # - POSTGRES_DB=${POSTGRES_DB}
     ports:
@@ -16,6 +16,8 @@ services:
     #
     # networks:
     #   - yournetwork
+    secrets:
+      - postgres_password
     volumes:
       - postgres_data:/var/lib/postgresql/data
     restart: unless-stopped
@@ -27,6 +29,10 @@ services:
 #   yournetwork:
 #     external: true
 
+secrets:
+  postgres_password:
+    file: secret.postgres_password.txt
+
 volumes:
   postgres_data:
     driver: local