Multiple .env setup in CI/CD

a question about multiple .env files and best practices to handle them with docker-compose.yml or gitlab-ci.yml.

SCENARIO

I have a basic setup with a couple of services defined in docker-compose.yml and a gitlab-ci.yml file that runs the build, tests etc. in Gitlab pipelines. On local, there's also a .env file.

In docker-compose.yml, I load the .env file with

service_name:
  env_file:
    - .env

The loaded environment variables contain:

1. Passwords.

2. Configuration eg. DOMAIN_NAME. I load this in docker-compose.yml with ${ENV_VAR}.

So far so good.

PROBLEM

This .env file should be omitted from source control since it contains passwords. That causes builds in Gitlab pipelines to fail since ${ENV_VAR} is not defined anymore.

In my use-case, the passwords are not required to build, but the configuration is.

SOLUTION?

Possible solutions were:

1. Define the configuration variables in Gitlab UI under Settings/CI/CD/Variables.

2. Use export to inject them into the container during pipelines.

These solutions do seem error-prone.

IDEAL SOLUTION?

It were best to define multiple .env files, eg. master.env (with configuration), local.env (with passwords) etc.

Only master.env is part of source control and local.env is not. During build on pipelines, it must not break due to missing local.env.

What is the best practice to achieve this with docker-compose.yml & gitlab-ci.yml`?