For webapps with vps backends the recommendation is to use environment variables. In order to get said environment variables onto the remote machines I tend to use Ansible in conjunction with ansible-vault for encryption.
The one issue that has popped up here with the env var approach is that our system administrators are not used to the idea and this creates friction when deploying new apps or updated certs.