The composer configuration should also be maintained via home-manager. The files are added to this repo and added via xdg. The auth.json is crypted of course as it contains my personal tokens.
Configure ssh, use git-crypt to crypt the configuration. That way no information like domain name, ip, port, username, etc. are exposed.