Encrypt template?

[mauvehed]

Is it possible to encrypt a .tmpl file or a template stored in .chezmoitemplates ? I'm not seeing a way to do this.

What I'm trying to accomplish, perhaps there's a better way, is to encrypt part of a file and not the whole thing. The file itself is a .tmpl and has a dynamic include {{ template "file" }} that's based on the OS chezmoi is being installed on. It's just that secondary template that I want encrypted.

[twpayne]

The easy way to do this is to use the decrypt template function, something like:

{{ join .chezmoi.sourceDir ".encrypted-data.txt" | include | decrypt }}

Where .encrypted-data.txt is the file containing the encrypted data. The leading . makes chezmoi ignore it. You can create it with:

$ chezmoi encrypt -o $(chezmoi source-path)/.encrypted-data.txt unencrypted-data.txt

[mauvehed]

Much appreciated, I have the basics working. But have a few follow up questions.

1. I can cz edit the parent template file, but that won't have any impact on the encrypted file that's being included via template.
2. Is the only way to edit the encrypted file is to go through the manual process of encrypt/decrypt?
3. Can I store the encryption password in 1password and use {{ onepasswordRead }} to some how simplify that process?

(P.S. This project is amazing and I thank you greatly for its creation! I've read your other post on the challenges of OSS and I humbly give you my deepest gratitude for all that you do here)

[mauvehed]

You know what.. I think your own config may have given me a better answer.

https://github.com/twpayne/dotfiles/blob/master/home/private_dot_ssh/config.tmpl

{{ onepasswordRead "op://FLARM/SSH Config/notesPlain" .onepasswordAccount }}

This is basically what I was trying to achieve. But I've simplified a few different things, and now realizing I could just load this via 1P.

I'll still refer to my questions above. As I may need to encrypt some other things in the future. The problem even with 1P is that I can't easily cz edit this stored config, right?

[halostatue]

Correct. By and large, file encryption (including the use of onepasswordDocument) is recommended when you have easily managed chunks of code (I use that for ~/.aws/credentials chunks in 1Password) or entire files that should be stored on the server. Otherwise, it is recommended to use data retrieval from something like 1Password to get fields to fill in as appropriate.

[mauvehed]

Thanks again, @twpayne! Chezmoi has been a life saver I've been looking for the last 25 years!