Laravel + Codeship + DigitalOcean - How do you handle .env files?

If anyone here uses Codeship to deploy Laravel projects to DigitalOcean (or other non-AWS servers), I'm curious to know how you handle .env files.

Obvious method #1 is to simply SSH into the server and change the .env as needed when deployments happen. I don't like that solution. It requires a manual change to be made for (potentially) every deployment (potentially to multiple environments as well) as opposed to an automatic solution.

The method I'm using is to store my production .env variables in the Codeship project's environment variables, with a certain syntax (ENV_PROD_APP_NAME, ENV_PROD_APP_URL, etc.). Then I grab them all and write them to a .env like so:

touch .env
while IFS='=' read -r name value ; do
    if [[ $name == 'ENV_PROD_'* ]]; then
        envname=${name#*_*_}
        echo ${envname}"="${!name}>> .env    
    fi
done < <(env)

This solution is working for me for now, as its automatic and only requires me to add the environment variables to the Codeship project. However, I'm still not 100% on this solution, as a) I feel as though that's not really what the intended use is for Codeship's environment variables, and b) I can't help but feel like its a little dodgy storing potentially sensitive passwords, API keys, etc. in the Codeship project.

So - if anyone here deploys via Codeship (to a non-AWS environment, so EC2 Parameter Store isn't viable), how do you solve 'the .env problem'?