Thank you. Neat idea. But wouldn't it still expose SECRET_TOKEN? BTW. I discovered that Sync-in (like MySQL) supports the *_FILE convention. So I was able to use
services:
    secrets:
      - auth_encryption_key
      - onlyoffice_jwt_secret
    environment:
      - SYNCIN_AUTH_ENCRYPTIONKEY_FILE=/run/secrets/auth_encryption_key
      - SYNCIN_APPLICATIONS_FILES_ONLYOFFICE_SECRET_FILE=/run/secrets/onlyoffice_jwt_secret
...
secrets:
  auth_encryption_key:
    file: ./.secrets/auth_encryption_key.txt
  onlyoffice_jwt_secret:
    file: ./.secrets/onlyoffice_jwt_secret.txt

But, the docker-compose.onlyoffice.yaml file still needs a way to get the onlyoffice_jwt_secret without exposing it.
services:
  onlyoffice:
    secrets:
      - onlyoffice_jwt_secret
    environment:
      # - JWT_SECRET=[redacted]
      # - SYNCIN_JWT_SECRET_FILE=/run/secrets/onlyoffice_jwt_secret
      - JWT_SECRET=$(cat ./secrets/onlyoffice_jwt_secret.txt)
secrets:
  onlyoffice_jwt_secret:
    file: ./.secrets/onlyoffice_jwt_secret.txt