feat: Docker Compose files in repos

compose.yaml, docker-compose.yml and their variants tracked by git are
listed under Repos, their services' environment variables as secrets,
named service.VAR.

- environment as a map or a list, and <<: *anchors shared between
  services; the secret patterns pick the keys, the rest hidden, with
  compose.secretPatterns for compose files' own.
- ${VAR}, $VAR, ${VAR:?…} and variables without a value are marked as
  references; docker-compose.example.yml and the like are hidden.
- Jasypt values decrypt with the service's JASYPT_ENCRYPTOR_PASSWORD.
- A blue Docker icon, themeable with composeColor.

docs/config.md

@@ -75,6 +75,7 @@ theme:
   databricksColor: ["#ff757f"]
   repoColor: ["#c099ff"]
   springColor: ["#c3e88d"]               # Spring Boot config files
+  composeColor: ["#82aaff"]              # Docker Compose files
 ```
 
 A role lazysecrets doesn't know, a typo or one from a newer version, is

docs/keys.md

@@ -20,7 +20,7 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
 | `/` | filter the focused list by name or note ([how it matches](#searching)); `enter` keeps it, `esc` clears it. While typing: `ctrl+j`/`ctrl+k` move, `ctrl+y` copies, `ctrl+r` reveals, `ctrl+f` stars |
 | `` ` `` | switch the Sources pane between grouped by provider and a flat list; `enter`/`space` on a provider folds it |
-| `H` | show / hide what's hidden: [Spring keys](repos.md#spring-boot-config) that don't look secret, and files and repos with only those; shown dimmed |
+| `H` | show / hide what's hidden: [Spring and compose keys](repos.md#spring-boot-config) that don't look secret, example files, and files and repos with only those; shown dimmed |
 | `r` | refresh the focused pane |
 | `q`, `ctrl+c` | quit |
 
@@ -54,7 +54,7 @@ match case exactly.
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
-| `e` | open the selected SOPS, `.env` or Spring file, or a secret's file at its line ([how](repos.md#opening-files)) |
+| `e` | open the selected SOPS, `.env`, Spring or compose file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](sharing.md) to the selected item / share menu (also env files, [encrypted](sharing.md#sharing-env-files)) |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |

docs/repos.md

@@ -1,9 +1,9 @@
-# SOPS, .env and Spring files in git repos
+# SOPS, .env, Spring and compose files in git repos
 
 lazysecrets shows git repositories under **Repos**: their
 [SOPS](https://github.com/getsops/sops)-encrypted files (YAML, JSON,
-`.env`, INI), plain env files and [Spring Boot config](#spring-boot-config)
-as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
+`.env`, INI), plain env files, [Spring Boot config](#spring-boot-config)
+and [Docker Compose files](#docker-compose) as vaults, and the keys in them (`db.password`, `list[0]`) as secrets. A dot or bracket inside a key is
 escaped, `app\.name`, so it doesn't read as nesting.
 
 ## Which repos
@@ -47,7 +47,7 @@ Folders of dependencies and caches are never looked in, tracked or not:
 3. where the repo's `.sops.yaml` `creation_rules` say SOPS files go,
 4. the whole repo.
 
-`include`/`exclude` apply to env and Spring files too.
+`include`/`exclude` apply to env, Spring and compose files too.
 
 ```yaml
 providers:
@@ -100,10 +100,14 @@ providers:
     spring:
       secretPatterns:                           # Spring's: only what differs
         keys: ["(?i)(password|secret)$", "bearer$"]
+    compose:
+      secretPatterns:                           # and compose's
+        values: []
 ```
 
 A repo's `.lazysecrets.yaml` can set them too, the same way
-(`secretPatterns:`, `spring: secretPatterns:`), for everyone. Each list
+(`secretPatterns:`, `spring: secretPatterns:`, `compose:
+secretPatterns:`), for everyone. Each list
 comes from the first that sets it: the repo's for the type, the repo's,
 the config's for the type, the config's, the defaults.
 
@@ -113,6 +117,22 @@ document's keys get its profile, `spring.datasource.password (prod)`.
 Values Maven fills in at build time (`@project.version@`) are read as
 they are.
 
+## Docker Compose
+
+`compose.yaml`, `docker-compose.yml` and their variants
+(`docker-compose.test.yml`), tracked by git; `docker-compose.example.yml`
+and the like are hidden. Their secrets are the services' `environment`
+variables, as a map (`DB_PASSWORD: x`) or a list (`- DB_PASSWORD=x`),
+named `service.VAR` (`api.DB_PASSWORD`); a `<<: *anchor` shared between
+services is read too. The same [secret patterns](#spring-boot-config)
+pick them, the rest hidden, with `compose: secretPatterns:` for compose
+files' own.
+
+`${DB_PASSWORD}`, `$DB_PASSWORD` and `${DB_PASSWORD:?…}`, and a variable
+without a value (`DB_PASSWORD:`, `- DB_PASSWORD`), taken from where
+compose runs, are marked as references; `${DB_PASSWORD:-x}` has its
+default in the file.
+
 ## Decrypting
 
 Listing never decrypts: SOPS and Jasypt encrypt values only, so keys and
@@ -131,15 +151,17 @@ repo's history, or easily could be.
 
 ### Jasypt
 
-A value like `ENC(...)` in a plain `.env` or Spring file is
+A value like `ENC(...)` in a plain `.env`, Spring or compose file is
 [Jasypt](http://www.jasypt.org)'s, decrypted when it's revealed or copied
 with jasypt-spring-boot's default algorithm (3.0+:
 `PBEWITHHMACSHA512ANDAES_256`). The password is, as in Spring:
 
 1. `$JASYPT_ENCRYPTOR_PASSWORD`,
-2. the file's own: `jasypt.encryptor.password` in a Spring file,
-   `JASYPT_ENCRYPTOR_PASSWORD` in a `.env`; a `${VAR}` (or
-   `${VAR:default}`) in it is read from the environment.
+2. the file's own: `jasypt.encryptor.password` in a Spring file, the
+   service's `JASYPT_ENCRYPTOR_PASSWORD` in a compose file,
+   `JASYPT_ENCRYPTOR_PASSWORD` in a `.env`; a `${VAR}` in it (with a
+   default: `${VAR:default}` in Spring, `${VAR:-default}` elsewhere) is
+   read from the environment.
 
 Environment variables are lazysecrets' own: a link opened from the browser
 starts it without your shell's. A `.env` whose values are all Jasypt's