<story><title>Git-secret – store private data in a Git repo</title><url>https://coderwall.com/p/e-azzg/store-your-private-data-inside-a-git-repository</url></story><parent_chain></parent_chain><comment><author>jedberg</author><text>This project scares me because it helps foster a bad practice -- keeping secrets in a repo.  You really shouldn&amp;#x27;t be keeping secrets in the repo.&lt;p&gt;You should be using a secrets service that is designed for such a purpose, like Hashicorp&amp;#x27;s Vault[0], so that you never have to keep a secret in the code.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;hashicorp&amp;#x2F;vault&lt;/a&gt;</text></comment>
<story><title>Git-secret – store private data in a Git repo</title><url>https://coderwall.com/p/e-azzg/store-your-private-data-inside-a-git-repository</url></story><parent_chain></parent_chain><comment><author>Confiks</author><text>I&amp;#x27;ve been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible&amp;#x27;s vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`.&lt;p&gt;Very specific to Ansible, but works fine. It&amp;#x27;s a shame only files containing variables (we&amp;#x27;re using group_vars) can be encrypted, and not arbitrary files or templates.</text></comment>