Strategies for keeping private configuration application passwords out of the Source code

See more:

programming

We are looking at ways to keep the private keys, application password etc. out of all possible insecure locations such as JNDI, Source Code and thus completely outside of GIT/SVN version control system
.
Here's what I can think of:
Storing the keys on the server as System variables and grab them at runtime
Storing the keys in a private database (such as Redis/Raik) and configure the datasource on the server, grab the datasource through JNDI to query for the keys

Any other ideas/suggestions/comments??
Another goal is that we are still able to automate the changes to this config and keep it under the purview of the Contionus Integration/Automated deployment of code & configuration