CHEZMOI  is a nice, modern, secure dotfiles manager with built-in support for handling secrets and provides a nice configurable/hackable ecosystem to tinker with. Chezmoi is a batteries-included dotfiles manager .

Unlike yadm, chezmoi doesn’t just create a git repo of your user space .  Also, chezmoi supports integration with multiple password managers

Also, chezmoi is super nice with dotfiles. For example, .bashrc will be named as dot_bashrc

And if encrypted with chezmoi, it will be stored as encrypted_dot_bashrc.age

How to use age with chezmoi?

chezmoi age-keygen -o key.txt

chezmoi comes prepackaged with age. you just can run any age related command with just a chezmoi prefix

age ==> chezmoi age

and everything stays the same.

You can use chezmoi with age encryption with ssh, pgp, passphrase for recipient ..

I don’t recommend using a remote password manager to store secret values as I have faced delay in shell startup due to slow internet or dns related issues.

$callout💡 Always remember AGE_ (in caps) is your private key and should be stored safely ..and the one age.. (in small) is your public key and we will be encrypting this to this public key as an recipient $

The answer is yes and no.

If you have added a file as encrypted, Chezmoi will always keep that encrypted remotely.

chezmoi add --encrypt ~/.profile

will be stored as encrypted_dot_profile.age

BTW, you can use your GitHub account for the AGE recipient too (AGE can encrypt to SSH public keys). You can fetch the public SSH keys with:

curl https://github.com/<your username>.keys

For me, that’s

https://github.com/pratyay360.keys

This convention is followed by all the Gitforges, like GitLab, Codeberg, Source hut, etc.

If you want to use an SSH public key as the recipient in chezmoi, the general flow is:

Pick the recipient key you want to encrypt to (one line that starts with `ssh-rsa`).

Configure chezmoi/age to use it as the recipient (or export it in your shell), then add files with `–encrypt`.

you can integrate this with chezmoi config by hacking in your way.

If you generated an age keypair using:

chezmoi age-keygen -o key.txt

then:

key.txt contains your identity (private key) AGE\_(allcaps).

The corresponding age1... string inside that file is the recipient (public key).

So, I am storing my secrets in plain text in my dot files isn’t that bad and will not chezmoi mess by leaking my secrets.

answer is yes and no .

1st you need to configure a chezmoi config

something like this:-

encryption = "age"
[git]
autoCommit = true
autoPush = true
[delta]
by-side = true
numbers = true
[age]
identity = "/home/<username>/.config/chezmoi/keys.txt"
recipient = "public age key here"

If you have added a file as encrypted chezmoi will remember that and always keep that encrypted remotely.

chezmoi add --encrypt ~/.profile

will be stored as encrypted_dot_profile.age

Re-tracking a file after manual edits

If you edited a file directly (instead of using chezmoi edit), that’s fine.

If you want, chezmoi to re track the file from your home directory into the source state, run:

chezmoi re-add

This will re-add the file according to your current config (including encryption rules), so the repo still only stores the encrypted version when applicable.