I'm not sure I understand the concern. If they have shell access to your linode they already have access to everything - even if your db password were encrypted gitea can communicate with the db and so can any attacker coming from that system.