How to Encrypt Templates

[ProfessorManhattan]

Hey, I am trying to make it so that my Chezmoi installs everything regardless of whether or not an Age encryption token is passed in. I have a file like this:

encrypted_private_cloudflare.pem.tmpl

That looks like:

{{- if (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) -}}
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5SjhvRXp3eUdCcTgremRO
NjJyYlpxcFRkRlFQRGFNODN1TEVzZ0FhRUZJCmh4OStUbFA1eWlXWFVDRmNNNXJh
YmY4ZG5sQlJyTlZ4SnhKNmVObEhGTjAKLS0tIC9oQTh3c3RpeDhpaUUvSnRkeGFr
YUZhMmZVSGVOdlJjZFVHMEludldOSjgKpAjp7Ep6eZtDwBhrHEL7s9nA2ZVBy1Rs
VbBt2JUxRJqhCzUOLJRYwBC0YxknSJb7I184X/yYm/Vl/vKABwp0g4S3qokM4HlW
3lzHrAco6qctwn3bXWf2mmucGmq/d5iJ3flGaxGQpSaSUstkvPDJs1/Jz6MmKVEq
YbJ+ZSy0yvSVtuUDL3UqBNbzYgfL1Gs19jgUwW/lZpDqz1TyS1JTZR871KWJhc0H
SW8HgE5tBKbr09SqneNiABdL5hXbsZSUzimg1+4Nf/53Gfvq1hW04eT9iju9D16L
0Dj+RN2bI5Df33Msr0LLYyJ2z5z34K9IQgHSyGNweqJksXYKJ93mqAWRVFcgIiFh
E+IEQEO6lC+TbY7R07uDC7wQr3zUm8OaFF5NrMpvZTxiDuYJi1bmGdo6sUBMznCx
tz6tyAHSC5fBOsUHphi3JhBSr7TuvXiqoNtacOjG2FAsiL/sbRLHmTdzHemPxf15
qrptBqgaMyBeReyu8VU7YykTbXC6moOX7EFqPikuImKgC+H8zdqPYPwslo7Xrz5j
sFo8hSt9YRdvWj9Ymnz+n+V+mgXImFcJXX51Gibq00ZBzs/VpwXg6wMMeuiDgZ7W
Y3bdv3ieF2OVZSGm3Kc2mv59hy+AK6D4I8tjRQoqN2sB/cJvW4fHLlZ4UmwGzjaA
1vCVkXfj09smm5V/UCVR+Mw7lPc+TuJ/U+hRJI2Sx+4Yb0F6v3nBetbPWtsDID0y
9P+V+OwM/rgknEIzngrYuMgV7fxZDTAb1GSXaIZ6HUpLeyFBBRQcbsee75vqPDbz
8mBrQjSzFIOjDPhRiKd4o8wWqEantAi6ZbJvGtuZQ6FmQ9zjScbD//Qim0n6B+iE
xdyM2AzfIPxhYbPx1ONncRGKu04Cag2hh2Dpg0oZ5CdLblmKQQQpzb2C5YowMSJN
mgbRXbutNJTS42KePnuOl7X7ylqZk5IdBsjeygVN49X+GShT2WK7AZSmNXIibU2b
CMhAB87qHI270a7lVFsW44OxakThe83u9Ea5M7qFbUWV4MDsgcJkQY+01coV/6Fg
r+XMtILQlcCYHqmf88jqAuPx6sd5latYtGZmOwrQ9w0bpgdOMxr9TDiHNROZegVU
S4t4LXF71dDP9arBz1xavgPCqiCyHzWYiBfzO4P4P1Scon9mzAmaMK8VCjf7DW8C
DCL+pM4rT52AN8u9Hp5UBn0QjJKPu+v+VGq/3S03FZFOZSypwe8BRuyxUtJZDhr7
BuorkjCvu3KDT7fqHu7TloyBS/IGDJ3/1tTYyJj058CIz4/KlbOOjHt72wkbVTXc
rGovL09AxzgutdmgQznX7kf/W9LuNmwOBv5mCfQ/wKTlqv6fDQOi9nM0lIUD1ij4
dul7N14DFVKi174K5ero+N00FQsbDIAzxshltEzLUFCSrHuJGpY4wGNAOL/ixV9z
GTM0ON8wmOLBz9ZFc29bym7pXF0+7FKUKUpUk2P7QT8EfUEfVo899w0/xBy2rxJc
znJP1YF1VlM3MhNex8m2HBIVenadovq3LpbOK2HTnqRejw5rawu2z3V5RN62KxA=
-----END AGE ENCRYPTED FILE-----
{{- end -}}

But its trying to decrypt it before analyzing it as a template. Any ideas on how I can get something like this to work?

[halostatue]

I don't think that this is possible. You may need to encode things separately and use something like hexDecode.

[twpayne]

But its trying to decrypt it before analyzing it as a template.

Correct, when chezmoi sees encrypted_*.tmpl, it decrypts first and executes as a template second.

Any ideas on how I can get something like this to work?

The easy way is to use .chezmoiignore to ignore the file unless ~/.config/age/chezmoi.txt exists, i.e. put the following in your .chezmoiignore:

{{ if (not (stat (joinPath .host.home ".config" "age" "chezmoi.txt"))) }}
cloudflare.pem
{{ end }}

This will cause chezmoi to ignore cloudflare.pem unless ~/config/age/chezmoi.txt exists.

Alternatively, you can pass --exclude=encrypted to chezmoi apply.

[ProfessorManhattan]

Thanks so much for consistently supporting your software!