We store our repos on private repos and we have a script on deploy to replace the wp-config with the actual server details on deploy.