Switchtower and passwords

Is there a best practice for handling passwords when deploying a rails
app. For instance, perhaps during the deploy step the password will
get added on the fly after the checkout on the server.

Perhaps a simpler approach would be for the database.yml to be picked
up from a symbolic link to the shared directory?

Thanks,
Tom