templating with include_template of an encrypted file

[garrettreid]

I'm using a template to conditionally pull in (and decrypt) a source file, e.g. {{ includeTemplate "dot_ssh/personal_config.age" | decrypt }}. (This template is coming from .chezmoitemplates, so doesn't need the .tmpl extension.) As far as I can tell, the | decrypt is necessary since I can't chezmoi add something in .chezmoitemplates and thus can't mark it as encrypted.

I believe the template parsing is run before the decrypt, as my template variables aren't be interpreted. In the encrypted personal_config file, I have a line User {{ .systemname }}. Testing with a chezmoi apply --dry-run --verbose, this comes through into my .ssh/config literally as User {{ .systemname }}.

I've read through the discussions here (and there's a ton of good content I've learned from!), but didn't find anything about encrypted .chezmoitemplates files. What's the right way to approach this?

[garrettreid]

If the comment in this discussion thread is correct, this isn't currently possible.

[twpayne]

I believe the template parsing is run before the decrypt, as my template variables aren't be interpreted.

That is correct. includeTemplate reads and parses the file as a template, so in your example it is parsed as a template before being passed to decrypt.

Note that chemzoi does support encrypted templates, for example a file encrypted_dot_foo.tmpl in your source directory will be decrypted then executed as a template, and finally used to populate .foo.

At the moment, I don't think there's a way to use encrypted templates in .chezmoitemplates.

[twpayne]

As a further comment, if you're using age encryption a lot, then you may inadvertently be recreating your own password manager. Consider using gopass or KeePassXC instead -- chezmoi has builtin support for them both as template functions without requiring an external binary.

[garrettreid]

FWIW, I'm using this for large blocks of content that seem inappropriate for a password manager. In this case, ssh config definitions of various raspberry pis that I don't want to expose to the work environment.