TL;DR: Set them in a way, that makes you able to keep them in synch easily.
The environment key is always for the surrounding image only.
Usually you are passing those environment variables to the postgresql container to configure it.
Then you have to makje sure that all clients use the same credentials as passed into the postgres container. How you do this often depends on your overall architecture.
Most of the time its just hard-configuring them in the config/<env>.exs or passing them as environment variable into the client container as well.
But vault managed credentials are possible as well. Well, kind of… Changing the credentials for a repo requires it to kill the repos supervisor and restart it with new credentials as far as I understand…
