CHEZMOI  is a nice, modern, secure dotfiles manager with built-in support for handling secrets and provides a nice configurable/hackable ecosystem to tinker with. Chezmoi is a batteries-included dotfiles manager .

Unlike yadm, chezmoi doesn’t just create a git repo of your user space .  Also, chezmoi supports integration with multiple password managers

Also, chezmoi is super nice with dotfiles. For example, .bashrc will be named as dot_bashrc

And if encrypted with chezmoi, it will be stored as encrypted_dot_bashrc.age

How to use age with chezmoi?

chezmoi age-keygen -o key.txt

chezmoi comes prepackaged with age. you just can run any age related command with just a chezmoi prefix

age ==> chezmoi age

and everything stays the same.

You can use chezmoi with age encryption with ssh, pgp, passphrase for recipient ..

I don’t recommend using a remote password manager to store secret values cz I have faced delay in shell startup due to slow internet or dns related issues.

$callout💡 Always remember AGE_ (in caps) is your private key and should be stored safely ..and the one age.. (in small) is your public key and we will be encrypting this to this public key as an recipient $

So, I am storing my secrets in plain text in my dot files isn’t that bad and will not chezmoi mess by leaking my secrets.

answer is yes and no .

1st you need to configure a chezmoi config

something like this:-

encryption = "age"
[git]
autoCommit = true
autoPush = true
[delta]
by-side = true
numbers = true
[age]
identity = "/home/<username>/.config/chezmoi/keys.txt"
recipient = "public age key here"

If you have added a file as encrypted chezmoi will remember that and always keep that encrypted remotely.

chezmoi add --encrypt ~/.profile

will be stored as encrypted_dot_profile.age

Re-tracking a file after manual edits

If you edited a file directly (instead of using chezmoi edit), that’s fine.

If you want, chezmoi to re track the file from your home directory into the source state, run:

chezmoi re-add

This will re-add the file according to your current config (including encryption rules), so the repo still only stores the encrypted version when applicable.