The duplications are making me think a tiny bit:  We had two dimensions of default->override behavior.  One for non-secret -> secret and one for shared_env_btw_service_variant -> customized_env_for_service_variant.  The one use case for having these files would be for the non-secret settings for each service, which could then be overridden by the secrets specified via var_files (it works, happily, perhaps by chance).  But maybe keeping both dimensions is just too confusing ultimately?