When I previously used Azure DevOps for CI/CD, we would store secrets like database passwords in Azure DevOps environment variables, and then during the CD phase the appropriate environment's passwords would be injected into the connection strings in config files. This meant that the passwords were never stored in the repo itself.
I'm now trying to configure CI/CD in our self-hosted GitLab instance and have it working at a very basic level but I'm wondering how I go about doing the same thing as I did with Azure DevOps. I have created environments for my project and variables (masked and protected) for each environment. But is there a way to inject the values of the variables into config files during a CD deployment job?
I think for the Azure DevOps pipeline we executed a PowerShell script to replace some placeholder text in the config files with the values of the variables at deploy time. Might a similar approach work with GitLab's CD pipelines? GitLab's documentation on where variables can be used doesn't seem to mention anything like this.