To use Docker secrets so that the secrets are encrypted on the host. Using Docker Swarm was the path of least resistance to set up my system monitoring stack.
Docker Compose can use secrets without Swarm, but my understanding is that the those are in plaintext on the host.
I prefer the MYOWN-16080 standard of
yy/dm/md/y/y
. Also the year units are randomly swapped for encryption