use docker secrets for db password

compose.yml

@@ -12,9 +12,11 @@ services:
       - DB_DATA_LOCATION
       - TZ
       - IMMICH_VERSION
-      - DB_PASSWORD
+      - DB_PASSWORD_FILE=/run/secrets/db_password
       - DB_USERNAME
       - DB_DATABASE_NAME
+    secrets:
+      - db_password
     networks:
       - proxy
       - backend
@@ -40,24 +42,33 @@ services:
       - backend
     healthcheck:
       disable: false
+
   redis:
     image: redis:8.4-alpine
     healthcheck:
       test: redis-cli ping || exit 1
     networks:
       - backend
+
   database:
     image: tensorchord/pgvecto-rs:pg14-v0.2.0
     environment:
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
+    secrets:
+      - db_password
     volumes:
       - postgres:/var/lib/postgresql/data
     networks:
       - backend
 
+secrets:
+  db_password:
+    external: true
+    name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
+
 networks:
   proxy:
     external: true