Lots of notes.
GitOps. Either FluxCD if you are on Kubernetes, or doco-cd if using docker compose. You will thank yourself later.
Use an external secret manager. Its worth figuring out, and then you have one source of truth, and one place to update the credentials.
Figure out your backup strategy, document it really well, and test it regularly.