Scripts for encrypting / decrypting secrets (to prevent them from being accidentally checked into git)

.gitignore

secrets/

decrypt-secrets.sh

#!/bin/bash

set -eu -o pipefail

if ! which gpg &> /dev/null
then
    echo "Error: gpg not installed." >&2
    echo "Please 'brew install gpg'" >&2
    exit 2
fi

if [ -n "${SECRETS_PASSWORD}" ]
then
    gpg \
        --quiet \
        --cipher-algo AES256 \
        --batch \
        --passphrase "${SECRETS_PASSWORD}" \
        secrets.tar.gz.gpg
else
    gpg \
        --quiet \
        --cipher-algo AES256 \
        secrets.tar.gz.gpg
fi

rm -rf secrets
cat secrets.tar.gz | gunzip | tar x
rm -f secrets.tar.gz

encrypt-secrets.sh

#!/bin/bash

set -e -o pipefail

if ! which gpg &> /dev/null
then
    echo "Error: gpg not installed." >&2
    echo "Please 'brew install gpg'" >&2
    exit 2
fi

if [ ! -d secrets ]
then
    echo "No secrets directory found.  Did you invoke as scripts/encrypt-secrets.sh?" 1>&2
    exit 1
fi

tar c secrets | gzip > secrets.tar.gz
rm -f secrets.tar.gz.gpg
if [ -n "${SECRETS_PASSWORD}" ]
then
    gpg \
        --quiet \
        --cipher-algo AES256 \
        --batch \
        --passphrase "${SECRETS_PASSWORD}" \
        --symmetric secrets.tar.gz
else
    gpg \
        --quiet \
        --cipher-algo AES256 \
        --symmetric secrets.tar.gz
fi
rm -f secrets.tar.gz

So, you check in source control the encrypted secrets, and after that add the secrets folder to gitignore?

@acecilia I would add the entry to .gitignore first.

Twitter discussion when this was originally posted: https://twitter.com/cellularmitosis/status/1055152885158289410