Is there a recognized practice for keeping security details in files excluded from version control? As settings.php also contains the database connection details and the site key among others, it is excluded from version control in .gitignore.

But there some modules, APC for instance that require some of their configuration to be added to settings.php. 

This means that some settings necessary for the site to run correctly may not be present in a site created from a git clone.

Is there a standard practice for dealing with this, ie enabling settings.php for source control and include-ing the security and other settings from different files, or vice versa?
We split our settings.php file into two separate files:


settings.php (for configuration that applies to all environments)
local-settings.php (for configuration that applies specifically to the current environment)


"settings.php" is stored in version control, while "local-settings.php" is excluded. Each environment has its own version of local-settings.php, which contains its database credentials and other configuration that applies only to that environment.

At the bottom of settings.php, we include the local-settings.php file.

/**
 * Check for a local-settings.php in this direcory. Include it if one exists.
 */
if (file_exists(dirname(__FILE__) . '/local-settings.php')) {
    include dirname(__FILE__) . '/local-settings.php';
}