To use Docker secrets so that the secrets are encrypted on the host. Using Docker Swarm was the path of least resistance to set up my system monitoring stack.
Docker Compose can use secrets without Swarm, but my understanding is that the those are in plaintext on the host.
Tuta mail is garbage. Used it for over a year and the search was terrible event when using the exact text from the mail. They also deleted my account despite me actively using it.
Look for a different mail service.